Assessment planning

An Assessment Owner begins with a specific subject, organization, business unit and period. The business unit identifies the operating scope; the owner identifies who will answer for the engagement. A hospital group might assess access practice for one facility over a defined period. The owner records the scope statement and the planned test count before a control test is scheduled.

The planning operation checks that the organization and owner membership fit and that the expected revision is current. It then places the assessment in Planned and creates linked test records for the selected controls. The line numbers make the plan reviewable. If the same operation arrives twice, its operation key identifies the prior result rather than creating duplicate tests.

• One accountable parent. Keep each activity linked to the relevant assessment, risk, control or finding so the next person can follow the same case.
• Named responsibility. Assign the record to the person who prepares the work and keep independent judgement with a separate reviewer where a decision is required.
• Visible outcome. Use the recorded state, result, date and evidence to explain what happened before moving the case forward.

Agree which organization and business unit each engagement belongs to. Set a clear rule for period boundaries, who can own the work and which controls enter the plan. A control owner should confirm the effective control before the assessment owner schedules its test. Decide how scope changes are reviewed once the plan has a revision.

For a rehearsal, plan one assessment with two controls. Confirm that each test points to the same parent assessment and the intended control. Retry the identical planning request and check that the plan and test list do not multiply.

Take an access review for one business unit and check that its owner belongs to the selected organization. Ask the control owner to confirm each selected control before planning. After the plan is accepted, compare its planned test count with the linked test lines and their sequence numbers. Retry with the same operation key and confirm the test lines remain the same. If the owner changes the scope, use the current revision so the earlier plan is not silently replaced.

• Assessment worklist — Assessments with a named owner, operating unit and current status.
• Assessment period schedule — The planned period and current assessment state in one schedule.

Follow the related process and check the record definitions.