During an EHR security audit, auditors need structured tasks and a place to store working papers and evidence. What should they use in the engagement lifecycle?
Select an answer to reveal the explanation.
Short Explanation
Fieldwork is the job site: tasks say what to test, and working papers are the photos and notes you keep with the job. Email-only or CMDB screenshot classes aren’t an audit evidence model. Keep tasks and papers on the engagement.
Full Explanation
In the audit engagement lifecycle, fieldwork uses audit tasks (or equivalent work items) and stores working papers/evidence linked to the engagement. That structure supports reviewability and traceability. Unstructured email, CMDB sprawl for screenshots, or Vendor Risk questionnaires as the only container are not the Audit Management fieldwork pattern.