Auditee groups must upload evidence for fieldwork tasks. What permission boundary should remain in place?
Select an answer to reveal the explanation.
Short Explanation
Auditees can drop the documents in the inbox; they shouldn’t stamp the case Closed themselves. Task them for evidence, keep finding closure with Audit. That’s the permission boundary.
Full Explanation
Auditee groups should receive tasks to provide evidence but must not have permission to close findings unilaterally. Evidence contribution is expected cooperation; finding closure remains with Audit to protect independence and reporting integrity. That permission boundary is fundamental for municipal engagements.
Allowing auditees to create, edit, and unilaterally close all findings without auditor review lets the inspected party end the inspection. Giving auditees the audit manager role so they can rewrite engagement objectives collapses governance. Granting platform admin so evidence folders are easier to manage is extreme over-privilege unrelated to evidence upload needs.
Exam caveat: auditees supply evidence via tasks; auditors own finding closure and engagement objectives.
Operational check: assign auditee evidence tasks; confirm upload works; attempt finding close as auditee and verify denial; keep audit manager role off auditee groups; avoid platform admin grants for evidence logistics.
Configure auditee portals or task lists for evidence upload with clear due dates, while ACL rules block finding state transitions to Closed for auditee roles. Test the boundary with a negative ACL test each release that touches audit permissions.