02 — Capability · BC-160.20
Audit Execution
Carry out each engagement to a consistent method — scope agreed, controls tested, evidence kept — so the conclusion can be defended to anyone who asks.
- Audit Fieldwork
- Audit Engagement
- Audit Testing
In scope
- Engagement scoping and planning
- Fieldwork testing and evidence
- Workpaper standards and review
Out of scope
- Compliance testing by the second line (see BC-140)
- Security penetration testing (see BC-760)
Decomposes into · 4
- BC-160.20.10Engagement ScopingAgree the objectives, boundaries and timeline of each audit with the auditee before fieldwork starts.
- BC-160.20.20Fieldwork & TestingGather evidence, test controls and transactions, and analyze data to reach conclusions about what is working and what is not.
- BC-160.20.30Workpaper DocumentationRecord procedures, evidence and conclusions so a reviewer can retrace every finding to its support.
- BC-160.20.40Audit ReportingWrite reports that state the finding, the risk and the agreed action plainly enough that management and the committee act on them.