Assessment planning

An assessment should say what is being examined, for which organization and business unit, and during which period. The Assessment Owner records a subject and scope statement, then names the organization, counterparty unit and owner. The planned test total gives the team a check against the individual control tests linked to the engagement. Revision records help reviewers identify which plan they saw when a decision was made.

Consider a review of a campus unit’s access control for a term. The owner defines the period and links the controls that will be sampled. Each test line has a sequential place in the plan and points to a control. The control code and linked control should identify the same check. If a new control is added after planning, the owner reviews the planned total and assessment revision before asking testers to proceed.

• Scope. Subject, statement, organization and business unit explain what the engagement covers.
• Period. Start and end dates frame when the control work belongs.
• Test plan. Linked test lines show which controls need evidence and results.

Choose the first assessment period and a unit with an accountable owner. Agree who may change scope after testing begins and what change requires a new revision. Decide how the team records a test that cannot be completed so it is not mistaken for a passing result. The planned test total should match the intended test lines before the team treats the plan as ready.

Check membership for each assessment owner against the organization. The unit and organization references should agree, because a review tied to the wrong unit misdirects both risk reporting and reviewer access. Give the Independent Reviewer enough context in the scope statement to judge the work without asking a tester to rewrite it later.

Open one draft engagement with its period and linked tests. Ask a Control Owner to find the assigned control and tell the Assessment Owner what sample can be examined. Compare the recorded planned total with the linked test lines. Ask the Independent Reviewer to identify the revision and scope they would review. If a test line or owner is ambiguous, correct the plan before execution. The owner should also check that the linked control belongs to the risk being assessed and that the organization still matches the selected unit.

• Assessment Period Schedule — Planned and active assessments arranged by their period dates.
• Assessment Status Board — Engagements organized by current assessment status.

Use assessment planning for the scope handoff and testing and findings for test results.