Assessment planning

An Audit Manager needs to know what an assessment covers before assigning fieldwork. Start with the subject, audit year and period dates. Use the scope statement to explain the business activity being examined and the evidence the Auditor expects to collect. A subject such as supplier access review is more useful when its scope also names the organization and the period under examination.

The assessment stays available as a reference for findings and risk workpapers. Those links help the team distinguish work belonging to the current exercise from an earlier review. Organizations and business units provide the operating context; the Auditor checks those references when preparing the related records. Operations Overview gives the team a place to inspect engagement, testing and finding workload across its authorized portfolio.

• Period. The Auditor records the audit year, period number and opening and ending dates. The Assessment Calendar makes overlapping exercises visible before the Audit Manager commits the team to further work.
• Scope. The scope statement describes the question being examined. Keep the description specific enough that an Auditor can decide whether an additional finding belongs to this assessment or needs a separate exercise.
• Operating context. Admin maintains the organization and business unit directories. The Auditor checks the organization on each related finding or risk workpaper instead of relying on a similar business name.

Agree how the team names assessments and handles periods that cross a calendar year. Decide who may change the scope after fieldwork begins and how the Audit Manager will review that change. Write the decision into the team’s operating procedure so a revised scope does not quietly exclude evidence already collected.

Also agree when an assessment can move from Open to Closed, and when Locked is appropriate. Review the linked findings and workpapers before making that decision. The assessment state describes the exercise; the team still needs to inspect the individual response records when explaining unresolved work. Set the permitted organization access for each participant before loading a wider portfolio.

Rehearse a quarterly supplier access review for a subsidiary. The Auditor enters the period dates and explains which access changes the exercise covers. Admin checks the subsidiary and business unit names. The Audit Manager then reads a sample finding linked to the assessment and confirms that its subject falls within the stated scope.

Next, introduce a finding concerning an earlier period. Ask the Auditor to identify the correct assessment and explain the choice. Before closing the exercise, inspect its linked risk workpapers and the response dates on its findings. This rehearsal tests whether the scope is usable when a real exception arrives, as well as whether the calendar is readable.

• Assessment Calendar — Read the period boundaries and current state of each assessment.
• Active Organizations — Check the organization identity used in related audit records.

Continue with assessment and engagement preparation and review the implementation plan.