During an EHR security audit, auditors need structured tasks and a place to store working papers and evidence. What should they use in the engagement lifecycle?
Select an answer to reveal the explanation.
Short Explanation
Fieldwork is the job site: tasks say what to test, and working papers are the photos and notes you keep with the job. Email-only or CMDB screenshot classes aren’t an audit evidence model. Keep tasks and papers on the engagement.
Full Explanation
During an EHR security audit, structured fieldwork requires audit tasks with working papers and evidence attached to the engagement. Tasks define what to test; working papers and evidence preserve how conclusions were reached for clinical security reviews. That engagement-centric evidence model is the Audit Management fieldwork pattern for civic hospitals.
Email threads only, with no tasks or evidence linked to the engagement, produce ungoverned proof. A new CMDB class for each screenshot collected during interviews abuses CMDB as an evidence store. Vendor Risk questionnaires as the sole fieldwork container for clinical security misuse TPRM objects for internal audit fieldwork.
Exam caveat: fieldwork = engagement tasks + working papers/evidence. Email, CMDB screenshot classes, and vendor questionnaires are wrong containers.
Operational check: create fieldwork tasks on the EHR engagement; attach working papers and evidence to those tasks; prohibit email-only evidence SOPs; sample the engagement file for completeness before reporting.
Working-paper templates should require procedure performed, evidence reference, and conclusion fields so EHR security conclusions are reproducible. Store evidence on the engagement tasks, and ban CMDB class proliferation or vendor-risk questionnaires as fieldwork substitutes for internal clinical audits.