A performance audit plan is an agreed design connecting institutional objectives, evaluative questions, criteria, evidence and resources.
Begin with the decision the institution needs to understand, then ask whether relevant evidence can answer it. Scope, criteria and methods should form a coherent plan rather than a list of unrelated tests.
Selecting a consequential objective and formulating evaluative questions
discuss the audit criteria with the audited entity
— INTOSAI ISSAI3000, paragraph49 (planning/conducting requirement for adopting SAIs)
Planning a performance audit begins with selecting a significant, auditable institutional objective rather than conducting routine compliance checks. Performance auditing evaluates whether government undertakings, programmes, or public activities operate in accordance with the principles of economy, efficiency, and effectiveness.
Auditors must distinguish a performance audit from the annual audit of performance information. In South Africa, the Auditor-General South Africa (AGSA) audits reporting against predetermined objectives in annual reports to verify that reported service delivery information is useful and reliable. In contrast, a performance audit evaluates the actual measures instituted by management to ensure resources are acquired economically and used efficiently and effectively.
Planning requires formulating clear audit questions aligned with the three Es:
- Economy questions examine whether resources are obtained at an appropriate price, quality and quantity, when needed.
- Efficiency questions assess the relationship between operational inputs and delivered outputs.
- Effectiveness questions evaluate whether operational outputs achieve intended strategic outcomes.
Formulating precise evaluative sub-questions ensures that audit teams maintain focus on high-impact operational areas throughout the engagement lifecycle.
Establishing audit scope, approach, and suitable criteria
Defining the audit scope establishes the physical, operational, and temporal boundaries of the performance audit. The scope specifies the auditable programmes, operational units, time period under review, and specific geographic or administrative locations included in the assessment.
Auditors choose an audit approach tailored to the objective, such as a result-oriented approach assessing output achievement, a problem-oriented approach analysing underlying causes of operational failure, or a system-oriented approach examining management systems. Selecting suitable criteria provides objective benchmarks for measuring operational performance.
Suitable criteria derive from sound management principles, legislative frameworks, industry best practices, or comparative benchmarks. Performance audit criteria are qualitative or quantitative standards against which observed performance is compared.
Auditors should discuss proposed criteria with the audited entity during planning to foster a common understanding of performance benchmarks. Discussing criteria enhances transparency without compromising the auditor's independent selection authority.
Identifying feasible evidence, research methods, and audit risks
A successful performance audit plan identifies feasible evidence sources and reliable research methods before fieldwork commences. Evidence must be sufficient in quantity and appropriate in quality, meaning relevant, valid, and reliable.
Auditors select qualitative and quantitative data collection methods, including document inspection, physical observation, stakeholder interviews, and data analysis. Planning must account for data availability, ensuring that required records can be obtained efficiently without unreasonable cost or operational disruption.
Managing audit risk requires anticipating potential obstacles, such as incomplete data, uncooperative stakeholders, or complex operational dependencies. Auditors design specific audit procedures to mitigate these risks and maintain professional skepticism throughout the engagement.
Identifying evidence limitations during planning prevents unrealistic testing scopes and ensures that audit conclusions rest on verifiable operational facts.
Engaging stakeholders, project resources, and planned communication
Effective performance audit planning incorporates project management principles to deploy resources efficiently within designated timeframes. The audit plan specifies required staff competencies, research skills, specialist expertise, and budget allocations necessary to achieve audit objectives.
Auditors plan structured communication channels with the audited entity and relevant stakeholders throughout the audit process. Communicating key aspects—such as audit objectives, scope boundaries, criteria, and timeframes—improves access to information and fosters constructive professional dialogue.
Stakeholder communication must be managed carefully to protect audit independence and prevent conflicts of interest. Maintaining professional distance ensures that audit findings remain impartial, objective, and credible.
Planned communications outline how preliminary findings, management responses, and final reports will be transmitted to executive authorities and oversight bodies. An agreed reporting schedule identifies intended recipients, review steps and decisions so communication can be managed.
Contextualising ISSAI 3000 standards and institutional limits
When commissioning or executing performance audits, advisory teams and institutions must understand the statutory and methodological context governing performance audit standards. ISSAI 3000 is the authoritative International Standard for Performance Auditing developed by the International Organisation of Supreme Audit Institutions (INTOSAI).
ISSAI 3000 is explicitly intended for Supreme Audit Institutions (SAIs)—such as the AGSA in South Africa—that choose to adopt it under their constitutional or statutory mandates. An engagement's authority comes from its actual mandate and applicable requirements; a reference to ISSAI3000 alone does not establish authority or standards conformance.
This article adapts planning principles as recommendations. Where legislation, an institutional mandate or a contract requires a particular standard, identify that requirement explicitly. In South Africa, public sector performance audits conducted by the AGSA are governed by the Public Audit Act and section 188 of the Constitution.
Establish the engagement authority and applicable requirements before finalising the scope, access arrangements and reporting route.
| Audit Planning Dimension | Key Objective & Scope Focus | Primary Evaluative Criteria Source | Illustrative Evidence & Method |
|---|---|---|---|
| Objective & Question Selection | Select consequential operational objective and define economy or efficiency questions. | Strategic plan targets, legislative mandates, and policy objectives. | Qualitative review of policy outcomes and operational output ratios. |
| Scope & Criteria Definition | Establish operational boundaries, timeframes, and performance benchmarks. | Industry best practices, sound management principles, and comparative standards. | Comparative benchmark analysis and management policy inspection. |
| Evidence & Risk Management | Identify feasible evidence sources and design procedures to manage audit risks. | Data availability assessments and preliminary research pre-studies. | Sampled operational records, site observations, and data reconciliations. |
| Communication & Resourcing | Plan stakeholder communication protocols and allocate project resources. | Project management frameworks and stakeholder communication plans. | Structured progress briefings and management response review logs. |
Sources
Frequently Asked Questions
How does a performance audit differ from the annual audit of performance information conducted by the AGSA?
The AGSA's annual audit of performance information examines reporting against predetermined objectives in annual reports to verify usefulness and reliability. A performance audit independently evaluates whether management measures ensure resources are procured economically and used efficiently and effectively.
Does ISSAI 3000 automatically apply as a mandatory statutory standard for advisory firms?
No, ISSAI 3000 is an international standard created for Supreme Audit Institutions (SAIs) choosing to adopt it under public mandates. A commissioned institutional review should establish its own mandate and applicable professional or contractual requirements. Referencing the standard alone neither creates public audit authority nor proves conformance.
Why must performance audit criteria be discussed with the audited entity during the planning stage?
Discussing criteria with the audited entity ensures a common understanding of the quantitative and qualitative benchmarks used to evaluate performance. While discussed with management, final criteria selection remains the independent responsibility of the auditor.
How does an audit team address potential evidence limitations identified during audit planning?
When planning reveals that required operational data is unavailable or incomplete, auditors assess whether alternative evidence sources exist or adjust the audit scope. Any remaining evidence limitations must be explicitly documented and disclosed in the final report.
What role does risk assessment play in selecting performance audit topics and designing procedures?
Risk assessment helps identify high-impact audit topics where operational failure or inefficiency poses significant risks to public value. During planning, auditors design specific audit procedures to mitigate audit risks and ensure findings are objective and reliable.
For wider context, read the performance audit overview.