Build the audit timeline the evidence can survive

Objectives

Your programme manager drafts the audit plan: "period runs until the report is signed, we'll pull evidence once fieldwork starts, and the control owners will hand it straight to the auditor".

Every one of those three decisions creates a finding. Write the timeline record: the audit period the opinion covers, the date evidence is frozen, when fieldwork begins, who hands evidence over, and how exceptions found during the period are handled.

Engagement: SOC 2 Type II
Audit period agreed with the auditor: 2026-01-01 through 2026-06-30
Fieldwork opens: 2026-07-13 (a Monday)
Report target date: 2026-08-15

Firm requirement: the PBC population must be frozen five business
days before fieldwork opens, so late-arriving rows cannot change a
sample that has already been drawn.

Internal teams: platform-security, internal-audit, control-owners
External: the assurance firm

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Re-read the brief and name the trap

   Three separate dates get confused in almost every first audit: the window under opinion, the moment the population stops moving, and the day the auditor starts testing. They are not the same date and only one of them is negotiable.

2. Step 2

   Fix the period

   The fixture states the window the auditor agreed to cover. Anything after it is outside the opinion, including the report date the manager pasted in.

   Copy both endpoints exactly as the engagement states them.

   Audit period ends when the period endsFieldwork date matches the engagement

3. Step 3

   Count the freeze date

   The firm's requirement is expressed in business days, and fieldwork opens on a Monday. Walk backwards day by day, skipping the weekend, and stop after the fifth working day.

   A freeze on the same day as fieldwork freezes nothing: the sample is drawn from a population still receiving rows.

   Evidence freeze precedes fieldwork correctly

4. Step 4

   Decide who hands evidence over

   The auditor cannot collect your evidence for you; that would make them a participant in the control. Name an internal team that can reproduce every artefact on request.

   Evidence is handed over by an internal team

5. Step 5

   Say what happens to exceptions

   Exceptions inside the period exist whether or not you mention them. Removing them from the population is the one response that turns a control deficiency into an integrity problem.

   State a handling rule that involves documenting or disclosing them and remediating, without promising the exception disappears.

   Exceptions are disclosed, not hidden

Rules summary

• XP on pass

  35 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 9 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.