Audit scope and plan

1. Regulatory Concept & Core Standards

In this video we will work through a concrete decision: prepare an audit with defined criteria, limits and independence. The aim is to explain the criterion used and apply it to a workplace situation. We will start with the concept, move to the procedure and finish with a case to solve. An audit compares requirements with evidence of actual operation. It does not automatically certify the entire organisation. This course covers scope, records, functional testing and findings. Tests require authorisation, fictional information and protection of real case data.

Scope identifies entities, processes, periods and requirements. Criteria may come from law, policies and approved procedures, but distinguish those sources. Suggested good practice is not a legal duty without a basis. The team needs competence and independence from the work assessed.

Apply the following rule: Article 23 generally requires an internal procedure where at least 50 people perform paid work, assessed on 1 January or 1 July. Count employees as full-time equivalents and qualifying paid non-employees who do not employ others for that work. Specified regulated activities are exempt from the threshold; local public units have separate rules. Consult unions or worker representatives for 5–10 days; the procedure takes effect seven days after announcement under article 24.

2. Practical Implementation & Procedure

Define objectives and audit questions. Gather current criteria and plan sources and tests. Select samples and explain limits. Combine documents, interviews and demonstrations. Set minimum access and record protection. If the team recently designed the control, assess how to preserve review objectivity. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

The audit covers receipt and acknowledgement, but its draft scope promises assessment of every investigation. The team aligns the claim with the actual tests. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Can a limited test confirm compliance of the whole programme? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. The conclusion must reflect examined areas and evidence. Identify other requirements as untested or assess them separately.

One mistake to avoid is: using total-assurance language for an assessment covering only part of the programme.

Now apply the national rule to a second decision. A subsidiary copies its foreign parent’s procedure without assessing its own activities and size. What should it check?

Identify the Polish entity, sector and number of people under Article 23, using the correct reference date and counting method. Check sectoral and public-sector exceptions. Consultation and commencement under Article 24 also matter. A group template does not replace assessment of responsibility or the lawfulness of shared access.