Scope and Testing

Step by step

1. Define scope Control Owner

   The Control Owner chooses the organization, business unit, period and controls to assess. The scope statement gives the tester a boundary that can be checked later.

   • Sets the period, business-unit boundary and owned controls
   • Updates Assessments, Organizations, Business units, Risks, Controls

2. Confirm test plan Independent Assurance Reviewer

   The Independent Assurance Reviewer checks the planned tests and records the decision against the assessment revision.

   • Records the reviewer decision against a revision
   • Updates Assessments, Review decisions
   ApprovalA person approves before the work moves on.

3. Test controls Control Tester

   The Control Tester records a sample size, exception count, result and evidence reference against each control in the assessment.

   • Keeps sample and evidence with the test context
   • Updates Assessment tests, Assessments, Controls, Record attachments

4. Record findings Control Tester

   A failed test is described as a finding linked to its control and assessment, with severity that the remediation team can act on.

   • Gives a failed result a tracked issue
   • Updates Findings, Assessment tests, Controls

Control Owner

, Control Tester, Independent Assurance Reviewer