The objective in the testing strategy and fieldwork phase is to perform a risk/control assessment to determine the effectiveness of relied-upon controls and whether risks are adequately mitigated.
For most engagements, OHIA will perform process interviews to obtain a detailed understanding of the area or process under review. This information is utilized to perform our risk and control assessment and to develop the overall testing strategy for the work.
Once the testing strategy has been developed, the audit team sits down with the client to walk through the planned work. This allows the team the opportunity to discuss the test steps in detail, to obtain feedback from the client on the proposed testing and to evaluate how information will be obtained to support the planned fieldwork.
During this audit phase OHIA:
- Reviews key risks and control points with process owners
- Conducts test work – performs verification and data analysis to substantiate, measure and evaluate key controls and procedural compliance
- Documents testing procedures and results with appropriate supporting documentation in our work papers
- Discusses potential control gaps and audit findings with process owner(s), providing the opportunity for additional information to ensure we are not misunderstanding or misinterpreting the audit results
- Conducts routine status updates with client
- Drafts tentative issues and recommendations for Management’s response and Action Plans, based on testing exceptions, taking into consideration the risk criteria rating defined with the testing strategy
Planning – Fieldwork – Exit Conference – Audit Report – Follow-up