4 Scope? Audit Planning and Methodology
An audit that tries to verify everything verifies nothing.
🗂️ Tessera Case: “Just a quick health check”
Tessera’s CTO opens the second conversation with a request that sounds modest. “Before we go deep, can you just do a quick health check? A general sense of where we stand.” Reasonable, and dangerous. A “quick health check” has no boundary, no criteria, and no definition of done. It is the kind of engagement that swells until it is neither quick nor a check, and that ends with an opinion so vague no one can rely on it. Your job here is to resist the open-ended ask and replace it with something defensible: an engagement with a stated objective, a drawn boundary, and a moment when you can say, on the evidence, that the work is finished.
4.1 Scope before substance
You cannot audit everything, and you should not try. An information security management system touches every server, every account, every supplier, every line of policy, and every corridor with a lock on it. A certification-readiness audit has weeks, not years, and limited access. The gap between what exists and what you can examine is enormous, and the auditor’s first job is to close it intelligently rather than pretend it is not there.
Separate three decisions. Scope bounds the subject and period. Coverage records which applicable requirements will be assessed. Test depth determines the procedures and evidence needed for each. A broad scope can still have clear priorities. A short deadline does not permit silently omitting a required control.
A vague “all security controls” brief needs clarification before acceptance. Establish the service boundary, dependencies, evidence access and reporting limits. Revisit those decisions when new information appears, recording the reason and agreement.
4.2 The four things you must fix before you start
Before you review a single document or book a single interview, you must fix four things in writing. They are the legs the engagement stands on, and a wobble in any one of them propagates through everything that follows.
The audit objective is the question the engagement exists to answer. For Tessera, that question is specific: is Tessera’s information security management system ready for ISO/IEC 27001:2022 certification? Not “is Tessera secure,” which is unanswerable, and not “what is wrong with Tessera,” which has no end. A good objective is a question with a finite, opinion-shaped answer.
The criteria are the benchmark the subject matter is measured against. You cannot say whether something conforms without first saying what it should conform to. Tessera’s criteria include ISO/IEC 27001:2022 with Amd 1:2024, the necessary controls in its SoA, applicable obligations and its own policies. E01 and E03 record the teaching criteria. The criteria decide what counts as evidence and what counts as a finding.
The scope is the boundary: which parts of the subject matter the objective applies to. Which systems, which locations, which business units, which period of time, which controls. Scope turns the objective from an idea into a finite piece of work.
And materiality is the threshold that decides what matters. Significance guides priorities and the executive summary. Record supported nonconformities against applicable criteria even when they are individually low severity. Materiality is what stops the report from being an exhaustive catalogue of minor nicks and makes it a judgement about the things that affect the opinion.
The objective is the question; the criteria define “good”; the scope draws the fence; significance guides how findings are prioritised and communicated. Fix all four, and the engagement has a spine. Leave any vague, and you are back to the health check.
4.3 Materiality is not completeness
Coverage and significance answer different questions. Coverage asks whether required areas were addressed. Significance asks how a result affects the conclusion and action priorities. They are complementary.
A spelling error that changes no obligation may be an editorial observation. Missing evidence for a required access review is an audit issue even if no misuse was found. Do not import a financial-audit numerical threshold as permission to suppress management-system nonconformities.
Maintain a complete findings register, then write a prioritised executive summary. Where access or time prevents a required test, record the limitation and its effect on the opinion. “We did not assess it” is clearer than an unsupported low-risk conclusion.
4.4 The engagement letter
Scope decisions are only worth something if they are agreed, and agreement that is not written down is an argument waiting to happen. The engagement letter is where the four planning primitives, the objective, the criteria, the scope, the materiality threshold, become binding between you and Tessera. It is part contract, part charter. It says what you will do, what you will not do, what you need from Tessera to do it, and what you will deliver at the end.
A good engagement letter is boring on purpose. It names the parties, the criteria, the objective, and the scope boundary in language a board and a certification body would both recognise. It sets out responsibilities: Tessera provides access and accurate information; you provide competence, independence, and an evidence-based opinion. It records the deliverables, the timeline, and the fees. And it is honest about limits: what the audit will not catch, what “snapshot, not guarantee” means, and how findings will be raised if the picture changes.
The letter is also where the hard conversations happen early. If Tessera wants the acquired subsidiary included, that is a scope and a fee decision, made now, not in week three. If the CTO expects a clean opinion regardless of evidence, the letter is where you restate, in writing, that the opinion follows the evidence and not the deadline. A scope that everyone has read and signed is a scope that survives pressure. One that lives in a hallway conversation does not.
Scope has two enemies that look like virtues. Vanity scope is the impulse to put everything in, because a big scope looks ambitious and “thorough.” It is the health check in a suit. Scope creep is the slow drift that happens mid-engagement, when a curious finding tempts you to follow it past the boundary, or a stakeholder asks you to “just take a quick look” at something out of scope. Each ask sounds small. Together they turn a finished engagement into one that never ends. The defence is the same for both: every change to scope is a written decision, with a reason, a cost, and a signature. “While we’re here” is not a scope.
4.5 The six-stage audit lifecycle
This book groups the engagement into six practical stages. ISO 19011:2026 provides guidance on management-system auditing; the sequence below is a teaching arrangement, not a quotation of mandatory certification rules. Specific audit programmes may overlap stages and agree different follow-up arrangements.
The six stages, in order:
- Initiating. You establish contact, confirm the engagement is feasible, agree the objective, scope, and criteria, and form the audit team with the competence the engagement needs. The engagement letter is signed here, and the audit programme is begun.
- Preparation. You review the documents Tessera has given you, build the audit plan, and prepare the working papers, checklists, and test procedures that fieldwork will use. This is where the desk audit happens, and where most of an Act I engagement is lived.
- Conducting. The audit itself. The opening meeting, the gathering of evidence through interviews, configuration review, and testing, and the closing meeting where preliminary findings are shared. Evidence is gathered on terms you set, not on terms Tessera chooses.
- Reporting. You prepare the audit report: the findings in a defensible format, the conclusion, and the opinion. The report is drafted, reviewed, and distributed to the agreed recipients.
- Completion. The engagement is formally closed. Working papers are finalised and retained, lessons are captured, and the records that someone may need to reconstruct this audit in three years are put away properly.
- Follow-up. You verify that the corrective actions raised in the report have actually been taken and are working. An audit that reports a finding and never checks the fix is an audit that stops at diagnosis.
The stages are linear, but the decisions inside them are not. Initiation fixes scope, but preparation often forces a scope correction when the documents reveal something unexpected, and follow-up can reopen an engagement that completion thought was closed. The lifecycle is a spine, not a script. You move through it with your professional scepticism switched on at every stage.
4.6 The audit programme and risk-based scoping
The engagement letter says what you will do and where the boundary is. The audit programme says how, in operational detail: which controls you will test, which evidence you will gather for each, which sample sizes, which interviews, and in what order. This book uses “test programme” for the procedure list. Distinguish it from an audit programme covering one or more audits and an audit plan describing the activities and arrangements for a particular audit.
Start with applicable coverage, then choose proportionate depth. The risk register informs this decision, but its residual ratings depend on claims you may still need to test. High inherent exposure with low asserted residual risk can require deep testing of the controls responsible for that reduction.
Write the rationale for each procedure, population and period. If evidence is unavailable, record the gap rather than replacing an operating test with confirmation that a policy exists. Required coverage, evidence reliability and key-control dependence matter alongside risk scores.
4.6.1 A small procedure before the full test
Use E03 and one E04 record. Objective: all access disabled within the applicable deadline. Inputs: termination time, identity disable time and separately owned key disable time. Procedure: match the ID, check that all required credential types are represented, subtract termination from each disable timestamp, and compare the latest disable time with both two and 24 hours. Output: met, exception or insufficient evidence under each policy, with record ID and calculation.
A missing disable event is not automatically proof of active access. Request an independent event source or authorised state check. A current disabled state does not establish when historical revocation occurred.
🗂️ Tessera Case: Drawing the Tessera boundary
E01 fixes the scope: the Perth-managed SaaS ISMS, relevant customer-data flows and supplier dependencies. Direct testing of a supplier’s production systems is outside the granted authority. Tessera’s supplier governance and complementary controls remain inside the assessment.
E09’s payment report ends in December 2025. Its exception and missing current-period evidence mean reliance is unresolved. Record those requests and the effect of their absence. Do not write “covered by SOC 2” as though it were a completed test.
The opening mandate contains no subsidiary in this fixed scenario. If an acquisition were introduced, assess its interfaces and scope implications before deciding whether it can be excluded. A separate legal entity is not automatically outside an ISMS.
An illustrative draft says “exclude payment processing because the processor has SOC 2.” E09 does not justify that conclusion. Correct the procedure to inspect scope, period, exceptions and complementary user controls, then decide reliance. The missing bridge evidence remains a limitation. No model output can supply a report the case does not contain.
The fixed case includes an AI support assistant. An anomaly detector would require a separate work package; later chapters discuss that as a method extension without claiming a completed test. An AI system has a scope of its own: the model, relevant data, prompts and outputs, human review and integrations. State which components and operating period the engagement covers. A model-only test cannot establish the effectiveness of the surrounding control.
The sharper point is that AI changes what “in scope” means over time. A model that behaves one way today can drift after a retrain, so a control that passed in week 2 may not pass in week 8. Scope has to say when the AI surface was examined, and the opinion has to honour that snapshot. We will test AI-generated evidence properly in Chapter 7. Here, the lesson is simpler: an AI you cannot see on the security page is still part of the ISMS, and a scope that ignores it is a scope with a hole in it.
Time: 25 minutes. No AI required. Write a one-page scope and test programme using E01, E03 and E09. Include an access-revocation procedure and a supplier-reliance procedure. For each, state coverage, population/period, evidence required, permitted action and output. Separate an authority boundary from an evidence gap.
4.7 The question, answered
A bounded engagement can support a useful opinion even when evidence is incomplete, provided that the conclusion states the limitations. Next, make the technical objectives precise enough to test.