Advanced Audit planning for a utilities review should pull scope from live IRM data. What is the best scoping approach?
Select an answer to reveal the explanation.
Short Explanation
Advanced Audit planning is like loading the right parcels, hazards, and safety checks onto the inspection route from the live map—not from last year’s napkin. Pull entities, risks, and controls into scope from IRM. Spreadsheet islands miss the point.
Full Explanation
Advanced Audit planning for a utilities review should scope relevant entities, risks, and controls into the engagement from live IRM data. Live scoping ties assurance to current civic risk posture rather than last year’s napkin or a spreadsheet island. That is the architectural point of Advanced Audit planning in an IRM platform.
Ignoring entities and inventing a parallel list of systems only in a spreadsheet detaches audit from the entity framework. Scoping only ITSM assignment groups and never referencing risks or controls mistakes fulfillment queues for risk-based scope. Copying last year’s engagement verbatim without reviewing the current risk register ignores posture change.
Exam caveat: Advanced Audit planning pulls entities/risks/controls from IRM—not spreadsheets, assignment groups alone, or verbatim prior-year copies.
Operational check: open Advanced Audit planning; select utility entities with highest residual; pull related risks and controls into scope; reconcile against the live register before fieldwork kickoff.
After scoping from live IRM data, snapshot the selected entities, risks, and controls onto the engagement so fieldwork has a stable pack even as the register continues to move. Reconcile material mid-engagement residual spikes with CAE-approved scope updates rather than ignoring the live register entirely.