Complete IT Audit Lab 3 – Audit Planning, Scoping & Evidence

Before you begin

• You have finished Lab 2: submitted the Risk and Control Matrix and saved the debrief.
• The IT Audit Practical Laboratory is still attached and enabled on your Course Offering.

Open Lab 3

1. Open My Learning and the Course Offering Learning Experience.
2. Open Laboratories and launch IT Audit Practical Laboratory.
3. On the hub, open Practical Audit Lab 3 – Audit Planning, Scoping & Evidence.
4. Select Start Lab 3 (or Continue Lab 3).

Lab 3 uses the same AkwaabaPay engagement file. You do not re-type Lab 1 risks or Lab 2 controls.

Work the engagement

Use the Audit file menu:

1. Briefing — a strong conclusion starts with a precise plan. Read the worked examples (leavers, privileged access, merchant bank-detail changes).
2. Lab 2 input — your risks, controls, assessments, and deficiencies.
3. Evidence — earlier items stay available. Lab 3 adds EVD-20 to EVD-25, including management’s request to exclude the outsourced support provider. That is a proposal, not your decision.
4. Engagement plan — title, overall objective, audit period, and planning status.
5. Controls to test — select at least four key controls from Lab 2.
6. Objectives — write 2–4 assurance questions. Link related risks and controls. The system will not draft them for you.
7. Scope & exclusions — choose systems, processes, controls, third parties, and data. Record exclusions with the impact on your conclusion.
8. Assumptions & limitations — keep these separate. Add a planned response for each limitation.
9. Audit programme — add at least six testable procedures. Each needs a population, sample approach, evidence, and exception condition.
10. Evidence requests — add at least six requests linked to procedures. Say exactly what you need, from whom, for which period, and in what format.
11. Coverage — check for risks without selected controls, selected controls without procedures, and procedures without requests.
12. Submit the Audit Programme and Evidence Request List, then complete the eight debrief questions.

After Lab 3

Your programme stays on the engagement file for Lab 4 (criteria mapping) and Lab 5 (testing). There is no single correct plan. Lecturers score whether another auditor could execute it.