Review IT Audit Laboratory progress

Before you begin

• Domain Laboratories are enabled for the institution.
• You have a teaching assignment on the Course Offering.
• The IT Audit Practical Laboratory is attached and enabled.

Open progress

1. Open My Teaching and the Course Offering workspace.
2. Open Laboratories and the IT Audit attachment.
3. Select Open IT Audit progress.

Review Lab 1

The progress table shows each learner’s Lab 1 status, risk count, and score.

1. Open the Lab 1 status link to see their IT Risk Register, evidence references, information gaps, and debrief answers.
2. Add comments and optional criterion scores (risk identification, business impact, risk assessment, control evaluation, evidence use, professional judgement). Weights are configurable on the Lab 1 rubric.
3. Save the review.
4. If the register needs more work, select Reopen submission. The learner can edit and resubmit. Previous submitted versions stay on the audit trail.

Review Lab 2

After learners submit the Risk and Control Matrix:

1. Open the Lab 2 status link to see selected risks, controls, classifications, design and implementation assessments, evidence references, Lab 1 control reconciliations, residual restatements, and the debrief.
2. Score the Lab 2 rubric (objective linkage, identification and classification, design evaluation, implementation and evidence, professional judgement, RCM quality).
3. Reopen if the matrix needs more work. Lab 1 data is not overwritten.

Cross-learner control analysis on the progress page compares key controls, potential deficiencies, and classification disagreement. It is not an answer key.

Review Lab 3

After learners submit the Audit Programme and Evidence Request List:

1. Open the Lab 3 status link to see objectives, scope, exclusions, assumptions, limitations, procedures, sample rationale, evidence requests, and coverage flags (selected controls without procedures, procedures without requests).
2. Score the Lab 3 rubric (objectives and scope, procedure design, evidence planning, population and sampling, professional judgement, documentation quality).
3. Reopen if the programme needs more work. Labs 1 and 2 data are not overwritten.

Cross-learner planning analysis compares selected controls, common exclusions, high-priority procedures, evidence requests, untested controls, and sample methods. It is not an answer key.

Review Lab 4

After learners submit the Criteria / Framework Mapping:

1. Open the Lab 4 status link to see selected procedures, primary and supporting criteria, justifications, relevance ratings, the governance mapping, and the ISO 27001 alignment response.
2. Filter by framework, procedure, or control domain. Export the mapping if you need a working-paper copy.
3. Score the Lab 4 rubric (control objective understanding, primary criterion selection, framework mapping, internal/regulatory criteria, professional judgement, documentation quality).
4. Reopen if the mapping needs more work. Labs 1–3 data are not overwritten.

Do not mark solely against identical criterion identifiers. Reward logic, criterion strength, relevance, and justification. Professionally defensible alternatives are acceptable.

Cross-learner criteria mapping compares common primaries, framework use, procedures with disagreement, internal policy versus framework as primary, and framework overuse. It is not an answer key.

Review Lab 5

After learners submit the Testing Worksheet and Exception Register:

1. Open the Lab 5 status link to see selected procedures, evidence receipts, population assessments, workpapers, analytics, anomalies, the Exception Register, management explanations, and the potential findings queue.
2. Mark individual exceptions as defensible, needs more evidence, misclassified anomaly, criterion mismatch, weak conclusion, or strong professional judgement. Learners do not see this assessment until the file is submitted unless you configure otherwise.
3. Export the exception register if you need a working-paper copy.
4. Score the Lab 5 rubric (test execution, evidence evaluation, analytics and population reasoning, exception evaluation, professional judgement, workpaper quality).
5. Reopen if the testing file needs more work. Labs 1–4 data are not overwritten.

Do not score solely on exception count or exact wording. Reward evidence linkage, procedure discipline, criteria application, and professional scepticism.

Cross-learner testing analysis compares common exceptions, controls with high exception rates, procedures with disagreement, challenged evidence, and which issues teams carry to Lab 6. It is not an answer key.

Review Lab 6

After learners submit the final audit pack:

1. Open the Lab 6 status link to see reporting decisions, formal findings (Condition, Criteria, Cause, Effect, Recommendation), management responses, the executive summary, overall conclusion, Audit Committee notes, and the reporting-pressure scenario.
2. Mark individual findings (strong finding, evidence weak, criterion weak, cause unsupported, risk overstated or understated, recommendation too generic, strong professional judgement, summary too technical, or conclusion not supported).
3. Export the findings CSV or open the print-ready report.
4. Score the Lab 6 rubric (finding development, risk rating and judgement, recommendation quality, evidence and traceability, executive summary and conclusion, management response and follow-up).
5. Reopen if the report needs more work. Labs 1–5 data are not overwritten.

Do not score solely on finding count, exact titles, exact ratings, or exact recommendation wording. Reward evidence, traceability, proportionality, reasoning, and judgement. Professionally defensible alternatives are acceptable.

Cross-learner reporting analysis compares common findings, average severity, root causes, criteria used, rating disagreement, exceptions often not reported, and overall conclusions. It is not an answer key.

Cross-learner analysis

On the progress page, Cross-learner risk analysis shows:

• Themes most learners identified
• Themes only one learner identified
• Highest average ratings
• Where priority ranks disagree

This is a comparison aid. It is not an answer key. Do not treat one register as the correct solution.

What Lab 1 is for

Students should leave Lab 1 having performed a risk assessment on AkwaabaPay, not having reproduced a model list of risks. Score defensibility and use of the evidence pack.