Engagement Process
Scope names the tracker, the governance forum, the period under review, and which finding sources are in (internal audit, regulator, self-identified, partner). Without that, teams argue about inventories instead of program design.
Sample size follows severity mix and closure volume, not a fixed percentage. We usually propose strata for open critical items, recently closed high items, and aging medium backlog.
Deliverables should serve two audiences from one evidence set: ops gets a fix backlog with owners; risk committees get residual-risk language. That split is intentional, not decorative.