Assessment Planning

A reporting cycle starts with an assessment for one organization and business unit. The Control Owner records the subject, period and scope statement, then sets a planned test count. This gives the tester and reviewer the same working boundary. A change to that boundary is visible through the assessment revision, so the team can tell which version was reviewed.

Suppose the team is assessing controls for a branch during a quarter. The assessment identifies that branch, the dates and the person responsible for the work. The linked risks and controls tell the tester which safeguards are in scope. An owner should not treat a broad title as a substitute for a precise scope statement; the next person needs to know what to sample and what falls under this cycle.

• Entity and branch. The assessment belongs to an organization and names the business unit under review.
• Period and scope. Start and end dates frame the work, while the scope statement explains the boundary in words.
• Plan and revision. The planned test count and revision help the reviewer compare a decision with the plan actually presented.

Choose the reporting calendar and the organization responsible for each assessment. Agree how the team will name business units, who can own a control, and what a useful scope statement includes. Decide when a plan is ready for independent review and who records that decision. The reviewer needs a real person and a defined handoff, especially when the Control Owner also prepares the return.

If a period spans several branches, decide whether the team will use separate assessments for each branch or one clearly described scope. Keep the source relationships understandable. A return package later points to its parent assessment; an ambiguous parent makes the package difficult to explain.

Create a draft assessment for a named organization and branch. Add the period, scope and planned tests. Link an active control whose owner can answer questions about its design. Have the Independent Assurance Reviewer inspect the plan and record a decision against its revision. Then change the scope and confirm that the earlier decision remains attributable to the earlier version. The team can begin testing when its review practice has accepted the current plan.

• Assessment status board — Follow draft, planned, testing and review work by owner and revision.
• Assessment period schedule — See the period boundaries for work moving toward testing.
• My assessments — Give each owner a direct list of their assigned assessments.

Continue with scope and testing and the review handoff. The data model shows how the assessment connects to later evidence.