Scoping, walkthroughs, evidence requests, exceptions and the report. Triage a live PBC list in the scenario sim.
35 min 200 XPSkills: Audit, Evidence
Brief
An audit is a project with five predictable phases, and almost every painful audit you will experience is a phase-one problem discovered in phase four. Scoping sets the system boundary and the period. Walkthroughs confirm the controls exist as described. The evidence request pulls the artifacts. Testing produces exceptions. The report turns all of it into an opinion.
A GRC engineer's biggest wins come early. Anything you automate before scoping saves weeks; anything you scramble to assemble during fieldwork is already expensive.
The audit period and the fieldwork window are different things. Evidence must cover the period, not the fortnight the auditors are on site.
Scoping, walkthroughs and the PBC list
Scoping fixes what is in and what is out: which systems, which entities, which period. The walkthrough is where an auditor traces a single instance end to end to confirm the control described on paper is the control performed in practice: it tests design, not operation, and one instance is enough.
The evidence request arrives as a PBC list: Prepared By Client. It is a spreadsheet of artifacts you owe, with due dates, and it is the single largest consumer of an internal team's time. Every line item you can serve from a pipeline instead of a person is compounding savings.
Five phases. Most of the pain in phase four was created in phase one.
Exceptions and their severity
When a tested item deviates, the auditor calls it an exception: the control did not operate as described for that instance. Exceptions are then judged: isolated with a compensating control may be recorded as an observation; a genuine failure is a deficiency; several related deficiencies can aggregate into a significant deficiency; and a failure that could produce a material misstatement or material impact is a material weakness.
Management writes a response for each. A response is a statement of intent, not a fix: nothing is remediated until the corrective action addresses the root cause and a later test proves it.
Severity is a judgement chain, and a management response sits outside it entirely.
The opinion
The report closes with an opinion. Unqualified, usually called clean, means the auditor found nothing that changes the conclusion. Qualified means there are exceptions material enough to name but not to invalidate the whole picture. Adverse means the controls did not achieve the criteria. A disclaimer means the auditor could not gather enough evidence to conclude at all.
A qualified opinion is not a catastrophe and hiding one is. Customers read the exception table; sales teams read the cover page. Your job is to make sure those two documents tell the same story.
Management responses and remediation
Every exception in the report gets a management response: a written reply from the organisation, printed in the report, saying what happened and what is being done. It cannot remove the exception. A fix late in the period shows the problem was found, not that it never happened.
The opinion depends on how bad the exceptions are. An unqualified opinion means the controls worked. A qualified opinion means one or more control objectives were not met, but the problem is contained. An adverse opinion means the problems are pervasive. Remediation is checked in the next period, when the auditor retests the control.
You cannot fix your way out of an exception that already happened.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The list that ate the quarter
Scenario sim+40 XP
Name the artifact, then name the phase being described.
Incident brief
Two days after kickoff a spreadsheet lands with 214 line items, each with an owner column and a due date, titled "Evidence Request: Q3". Your ops lead calls it "the auditor's homework" and assumes the audit firm will produce the contents.
Separately, the auditor books a 45-minute call to "walk one access request from ticket to provisioned account", and your ops lead declines it as duplicate: "They already have the evidence request, this is the same thing twice."
It is not the same thing twice. One phase tests whether the control is capable; the other gathers what is needed to test whether it ran.
1.1Name the standard term for that 214-line evidence request spreadsheet. (two words or the initialism)
1.2Name the audit activity the 45-minute end-to-end trace represents. (one word)
Task 2: Grading the deviation
Scenario sim+50 XP
Name what was found, then name the worst-case grade it could reach.
Incident brief
Testing of the change-approval control finds four of twenty-five sampled changes deployed with no approval recorded. Three came from the same engineer during an on-call week; the fourth touched the billing calculation and shipped a pricing error that reached invoices.
The engineering director responds in the workpaper: "Acknowledged. We will add a required approval field next sprint." He then asks the auditor to close the item, since the response has been provided.
The auditor notes the billing impact separately and asks whether the deficiencies aggregate.
2.1Name what the four unapproved changes are called in the auditor's testing. (one word)
2.2Given the billing impact, name the most severe grade this finding could aggregate to. (two words)
Task 3: Cover page versus exception table
Scenario sim+50 XP
Name the opinion type, then name what the workpaper actually contained.
Incident brief
The final report arrives. The exception table lists two unresolved deficiencies in logical access, and the opinion paragraph states that except for those matters, the controls operated effectively throughout the period.
Sales publishes a one-pager the same afternoon: "Independently audited: clean opinion, no findings." When challenged, the account director points at the workpaper where your VP wrote "we will implement quarterly recertification in Q1" and says: "It's already remediated, so effectively there are no findings."
3.1Name the opinion type signalled by the phrase 'except for those matters'. (one word)
3.2Name what the VP's Q1 sentence actually is in audit terms. (two words)
Task 4: Fixed in month eleven
Answer challenge+60 XP
What the report can and cannot say about a late fix.
Incident brief
In a 12-month period, change approvals were skipped for all deployments in months 2 to 9. The team found it in month 10 and enforced approvals in month 11.
Leadership asks the auditor to drop the exception because "it is fixed now" and to publish the fix wording as the auditor's own finding.
The auditor concludes one control objective was not met, but the problem was limited to change management.
Your programme manager drafts the audit plan: "period runs until the report is signed, we'll pull evidence once fieldwork starts, and the control owners will hand it straight to the auditor".
Every one of those three decisions creates a finding. Write the timeline record: the audit period the opinion covers, the date evidence is frozen, when fieldwork begins, who hands evidence over, and how exceptions found during the period are handled.
Engagement facts
Engagement: SOC 2 Type II
Audit period agreed with the auditor: 2026-01-01 through 2026-06-30
Fieldwork opens: 2026-07-13 (a Monday)
Report target date: 2026-08-15
Firm requirement: the PBC population must be frozen five business
days before fieldwork opens, so late-arriving rows cannot change a
sample that has already been drawn.
Internal teams: platform-security, internal-audit, control-owners
External: the assurance firm
The auditor has sent a "provided by client" list two days before fieldwork. Your CFO wants everything answered immediately to look cooperative.
Accept the requests you should fulfil as written. Reject the ones that fall outside the agreed scope, name the wrong period, or ask for more personal data than the test requires: rejection here means push back and renegotiate, not refuse to co-operate.
Verdicts are accept or reject. Every rejection needs one reason code from: out-of-scope | wrong-period | over-collection.
PBC list (fieldwork starts Monday)
R-1 Admin user listing for the in-scope production environment as at period end.
R-2 Complete HR file, including salary and medical leave, for all 214 staff.
R-3 Change tickets for the audit period, with approver and merge timestamp.
R-4 Backup restore test results for the two years preceding the audit period.
R-5 Access review sign-off covering the four quarters in the audit period.
R-6 Source code for the payments service, exported to the auditor's personal drive.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · GRC Fundamentals
Evidence 101
What makes evidence sufficient, appropriate and reproducible, and why a screenshot is the weakest artifact you can hand over.
