Identify the new knowledge, skills, and attitudes that team members need to complete the audit program successfully. For example, a team might need more (1) knowledge about the application to identify risks or (2) knowledge about audit techniques germane to the audit objectives. For skills, team members might need to learn how to design or apply specific audit techniques. With respect to attitudes, team members might need to develop professional skepticism or the willingness to suspend judgment temporarily while a team member explains a different way to think about some aspect of the audit program.

Learning issues are likely to emerge in the next phase. They may, however, emerge in any phase. When new issues emerge, add them to the set of learning issues.

1. Quickly determine:
   • Scope of the assignment
   • Time estimates for each phase
   • How you will know when you are done
2. Designate responsibility for each phase to two (or more) team members
3. Publish the learning plan

Planning the assignment to the point of committing to individual tasks makes it possible for you to accept responsibility for:

• Constructing the needed knowledge
• Developing the requisite skills
• Adding helpful attitudes to your repertoire
• Being aware of and fixing problems with learning or production processes

Spending a little time at the beginning of the assignment planning its achievement has the potential to enable team members to:

1. Plan their schedules to accomplish assignment objectives with the least effort and time while building trust in team members.
2. Recognize when things aren't going well soon enough to recover gracefully. If your team substantially exceeds its time estimates, figure out what went wrong and change how you estimate tasks accordingly.
3. Focus on learning new skills as well as doing the assignment so that you can apply the skills to similar tasks in the future.
4. Learn to collaborate with others in ways with the potential to improve work and personal life. Collaboration is hard. The whole education system has been tuned to individual achievement. The reward systems in many companies (with individual evaluations and raises) also encourage individual efforts. Organizations are, however, feeling the need to collaborate, which starts with individuals figuring out how to collaborate for their mutual benefit.

Identify the risks inherent in the application and develop audit objectives for assuring the manageability of the risks. Each risk to the application usually maps to one or more audit objectives.This means that the statement of a risk can be translated to a statement of one or more audit objectives. It is also possible for one audit procedure to yield evidence pertaining to more than one risk.

The audit objectives should be the simplest, smallest set of objectives that address the risks. "Simplest" means the simplest set of objectives you can envision actually working in the context. Unnecessary complexity is undesirable because it causes the results, e.g., an audit program, to be harder to communicate and understand and increases the costs of using them.

Good design is rarely easy, but the expression of good design should be simple. This approach to design works by gradual change. When you realize that the design is inadequate, change it based on your improved understanding of the context.

For each risk, specify the concrete situations in the auditee's application that the objectives are designed to detect or assure do not exist. For example, if the objective is to assure that purchases are authorized, then the audit program might need to be designed to identify the following situations:

1. Inadequate performance of specific control procedures (automated or manual) that would permit unauthorized purchases to be made
2. Existence of ways to circumvent authorization control procedures, either inadvertently or intentionally

Another way of characterizing these situations is to say that the audit provides assurance that purchases are authorized if the evidence it generates demonstrates that these situations are absent. Implicit in this statement is the assumption that the audit included procedures whose performance would detect these situations if they existed in the application.

For each situation for each audit objective, identify the simplest audit procedure(s) that would detect the existence of the situation or eliminate the situation as a risk to the application. Give the audit procedures names and explain them as succinctly as you can.

When it becomes obvious that audit procedures are overly complex or new situations need to be accommodated, reperform phases 3-5. Another way of expressing this is "refactor the audit program." Refactor phases 3-7 of the learning plan to keep it current with the best work your team can achieve.

When the audit program seems stable, i.e., no refactoring remains to be done, verify that the audit procedures really would detect the presence of situations that pose risk to the application or give adequate assurance that the situations do not occur.

At the designated time, publish the assignment and completed learning plan in your team folder in WebCT.