A&A-03 Risk Based Planning Assessment
Drive the scope and frequency of independent assessments from a documented risk assessment, so higher risk systems and processes are examined more often than lower risk ones.
4
artefacts
0
held by a system
0
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- The risk-based audit plan with the risk rating behind each entry · Policy repository / GRC workspace
- The risk assessment or register the plan was derived from · Policy repository / GRC workspace
- Evidence the plan was approved and then followed, such as completed engagements matched to planned ones · Policy repository / GRC workspace
- Records of plan changes when risk ratings moved · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- An audit plan that lists the same scope every year with no risk input
- Risk ratings recorded but not reflected in assessment frequency
- Plan approved and then not followed, with no record of why
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA&A-02 Independent Assessments · A&A-04 Requirements Compliance