CREATE IT PLANNING MEMO

1. You are the IT audit senior (or IT auditor representative) assigned. Your audit firm has several branches, but you are working this particular client from the Melbourne, FL office.
2. The IT audit will support the financial statement audit of Company XYZ, with a fiscal year ending on December 31, 20XX.
3. Discussions with the financial audit Director regarding IT audit involvement have already taken place, and are documented in work paper (w/p) 1000.1. IT auditors have not been involved in previous audits for this client.
4. Your team is composed of: IT Partner P, IT Manager M, IT audit Senior S and IT Audit Staff AS.
5. The audit timing includes: Planning will be performed during the sixth month of the year under audit; Interim audit procedures will take place during 2 months before the end of the fiscal year; Year-end procedures are scheduled for January through March of the year following the end of the fiscal year; and all work papers and audit documentation will be due by and signed off on April 30th of the year following the end of the fiscal year.
6. The IT audit is estimated to take 100 hours. Hours will be charged to client code: Company XYZ-0000.
7. An understanding of Company XYZ's IT environment is documented in w/p 1540.
8. The three relevant applications for the IT audit include are:

• All Accounting Application (AAA)used to capture and processing accounting related transactions. AAA is installed on a UNIX platform (or operating system), and uses Oracle database. AAA can be accessed via a Windows network.
• Financial Document Generator Application (FDGA)used to produce all types of financial reports and documentation. FDGA is installed on a Windows operating system, and uses Oracle as its database. FDGA is accessed via a Windows network.
• Human Resources and Payroll Application (HRPA)used to manage the company's human resources and process payroll. This application is hosted outside of the company, at a third-party organization called HRP-For-All.

1. The relevant application controls used to mitigate risks in this audit are listed in Exhibit 5b (these must be added to the IT Planning Memo). Use w/p 1000.2 for reference purposes.
2. Deviations or findings resulting from testing the relevant application controls will be documented in w/p 2302.
3. There will be no work of others (e.g., Internal Audit personnel, etc.) used in the IT audit.
4. Human resources and payroll services are performed by a third-party service organization called HRP-For-All, located in Austin, Texas. Deloitte, the service auditor, just finished issuing a report assessing the controls at the service organization for the period July 1, 20XX through June 30, 20XX. Controls at HRP-For-All were found to be effective.
5. There are no other areas identified within Company XYZ that IT auditors can assist with.