Section A. Engagement Planning (50%)

Determine engagement objectives and scope

Part A: Applying Topical Requirements in Engagement Planning

When we, as audit, risk, or finance professionals, begin to plan an engagement, we aren't starting with a blank piece of paper. We're stepping into a world that already has rules. Think of"Topical Requirements" as the specific, non-negotiable rules of the road for the area we are about to examine. They are the laws, regulations, industry standards, and critical policies that govern the topic of our engagement.

Recognizing how to apply these requirements is the difference between a high-value, relevant engagement and a superficial exercise that misses the point. If we are auditing the company's new data privacy initiative, the"topic" is data privacy. The"topical requirements" would therefore be regulations like the GDPR in Europe or the CCPA in California. These aren't suggestions; they are the benchmark for success or failure.

So, how do we practically apply them when building our objectives and scope?

First, we must identify them. This is an act of due diligence. We can't just guess. This step involves research and inquiry. We talk to the company's legal counsel. We meet with the compliance department. We read the latest regulatory updates from industry bodies. If we are looking at a bank's lending practices, we need to know the specific requirements of the Equal Credit Opportunity Act (ECOA) or the Truth in Lending Act (TILA). We list these requirements out. They form the primary"criteria" against which we will audit.

Once identified, the next step is to understand their impact. Not all requirements are created equal. A violation of one requirement might result in a minor internal penalty. A violation of another—say, an anti-money laundering (AML) regulation—could result in massive government fines, loss of a banking license, and severe reputational damage. We have to perform a micro-risk assessment on the requirements themselves. Which ones represent the greatest risk to the organization if they fail?

This risk assessment directly shapes our engagement objective. The objective must explicitly reference these critical requirements.

Let's look at a weak objective versus a strong one.

A weak objective might be:"To review the new customer onboarding process."

This is vague. What does"review" mean? What are we looking for?

A strong objective, built by applying topical requirements, would sound like this:"To provide assurance that the customer onboarding process, as redesigned in Q3, is in full compliance with the 'Know Your Customer' (KYC) provisions of the Bank Secrecy Act (BSA) and the bank's internal AML policy."

See the difference? This objective is sharp. It's measurable. It tells everyone—the audit team, management, and the board—exactly what we are testing and why it matters. The topical requirements (BSA, AML policy) are baked directly into the objective statement.

Now, let's talk about scope. The objectives define"what" we want to achieve. The scope defines"how much" and"where" we will look. The topical requirements are the single most important factor in defining a responsible scope.

If our objective is to audit for GDPR compliance, our scope cannot be limited to one office in one country. The GDPR's requirements on data sovereignty and cross-border data transfer force our scope to be global. We must look at how data flows between the EU and the US, or between the EU and data centers in Asia. The requirement itself dictates the boundaries of our work.

Similarly, the requirements define the nature and depth of our testing. A simple internal policy might only require us to interview people and confirm they've read it. A complex financial regulation like Sarbanes-Oxley (SOX) Section 404 is a topical requirement that demands deep, substantive testing. We can't just ask,"Do you perform this control?" We must select a sample of transactions and prove the control was performed effectively, over and over again. The requirement sets the level of evidence we need to obtain.

Applying these requirements also protects the audit function. Management in a business unit might ask for a"quick, high-level review" of their new trading platform. But if our initial research shows that this platform is subject to specific SEC and FINRA regulations (the topical requirements), we must professionally push back. We must explain that a"quick review" is not possible. The requirements demand a more thorough engagement to provide any meaningful assurance. Our scope must be sufficient to answer the question,"Are we compliant with the law?" We cannot, and should not, agree to a scope so limited that it prevents us from testing the most critical requirements.

In essence, topical requirements are our anchor. They ground our engagement in reality. They move our work from the realm of opinion ("I think this process looks okay") to the realm of fact ("This process is non-compliant with regulation X, and here is the evidence"). By identifying, risk-assessing, and embedding these requirements directly into our objectives and scope, we ensure our work is relevant, credible, and provides the exact level of assurance the organization needs to manage its most significant compliance and regulatory risks.

Part B: Elements Considered in Developing Engagement Objectives

Crafting the right engagement objective is an art and a science. It's where we, as assurance and advisory