Internal Audit must plan an engagement on the city’s payments environment with clear objectives and a defined period. What lifecycle step should they complete first in Audit Management?
Select an answer to reveal the explanation.
Short Explanation
You don’t start digging trenches before the survey flags are in the ground. Plan the engagement—objectives, scope, and period—then do fieldwork. Closing first or handing planning to control owners skips the audit lifecycle.
Full Explanation
Internal Audit planning an engagement on the city’s payments environment must first create and plan the audit engagement with defined objectives, scope, and period before fieldwork begins. Engagement planning is the survey-before-digging step: without objectives, scope, and period, fieldwork lacks a governed container. CIS-RC Audit Management lifecycle starts with planned engagements, not with closure or ITSM cleanup.
Closing the engagement and archiving working papers before scoping objectives inverts the lifecycle. Remediating all open ITSM incidents citywide is operational work, not audit planning. Assigning control owners the audit manager role so they can plan their own review collapses independence and ownership.
Exam caveat: plan engagement (objectives/scope/period) before fieldwork; control owners do not become audit managers to self-plan assurance.
Operational check: create the payments engagement; record objectives, scope entities, and period; obtain plan approval per CAE process; only then open fieldwork tasks—never close first or hand planning to auditees.
Store approved objectives and period on the engagement record and freeze scope changes behind a change note after fieldwork starts unless the CAE authorizes expansion. Keep ITSM incident remediation programs separate from audit planning workstreams even when both touch payments systems.