Phase I Planning

• Conduct a kickoff meeting with key stakeholders and confirm the engagement objectives, scope, approach, and management’s expectations.

• Provide a request for information two to four weeks in advance of onsite or remote audit fieldwork.

• Gain an understanding of the services and/or systems in scope, identify the related business and IT processes and participants, and schedule walkthrough interviews.

 

Phase II Walkthroughs

• Confirm our understanding of processes and controls with appropriate client personnel and collect evidence that controls operate as described.

• Evaluate the design of controls supporting achievement of the control objectives or control criteria and identify control gaps and recommended remediation, if any.

• Finalize the description of the services and/or systems in scope in the process narratives.

• Communicate control gaps and recommended remediation. For first-time-through engagements, this is provided in an interim management letter that is organized as a prioritized remediation plan.

​

Phase III Testing

• Finalize the description and review of the entity-level controls in place that establish the environment in which detailed control activities operate.

• Test the design of detailed control activities (for Type I reports) and their operating effectiveness (for Type II reports) for key controls called out in the report.

• Finalize the testing section of the report for testing performed and results.

 

Phase IV Reporting

• Draft the report and circulate it to management for review and comment.

• Gain agreement with management on exceptions noted, if any.

• Obtain a letter of management representations (AICPA requirement).

• Issue the report and, if applicable, the management letter containing our observations and recommendations for improvement of your business and IT processes and controls.