إنتقل إلى المحتوى الرئيسي

Roles and engagement teams

Internal Audit → Audit Engagements → Overview → Team

Two things decide what an auditor can do in Vantage: their role in the organisation, and their role on each engagement's team. Understanding how the two fit together explains almost every "why can't I do this" question in the audit module.

Two layers​

The organisation role is the ceiling. It is set once per person under Settings → Users and says what they may do anywhere in the product. For audit staff, three values matter:

Organisation roleMeaning in the audit function
ManagerThe Chief Audit Executive and audit managers. Acts on every engagement without being assigned. Approves the annual plan, issues and finalises reports, closes engagements.
AnalystAudit staff. May do audit work, but only on engagements they are assigned to, and only what their team role allows.
ViewerRead-only everywhere. Auditees given access to see their own findings and requests are usually viewers.

The engagement team role adapts the person within that ceiling. When a manager or lead auditor adds someone to an engagement team, they pick one of four roles. The same analyst can be lead auditor on one engagement, a plain auditor on another and an observer on a third; their powers follow the assignment.

Team roleOn this engagement
Lead AuditorEverything an auditor can do, plus review, plus managing the team.
ReviewerEverything an auditor can do, plus review.
AuditorFieldwork: the day-to-day audit work.
ObserverRead-only. Sees everything, changes nothing.
(not on the team)Read-only, exactly like an observer.
A team role can never lift someone above their organisation role

A viewer assigned as lead auditor is still read-only. The organisation role answers "may this person edit audit work at all"; the team role answers "and what do they do on this one".

What "fieldwork" and "review" mean​

Fieldwork is the work of the engagement:

  • Edit workpapers, attach evidence, raise and clear review notes.
  • Submit a workpaper for review.
  • Create workpapers, generate them from the work program, and raise evidence requests to the auditee.
  • Raise a finding from a workpaper that concluded an exception, and move it through its stages up to remediating.
  • Edit the work program (RACM procedures), milestones, and the engagement's objective, scope and methodology.
  • Draft and edit the report while it is in draft.

Review is the act of signing off on someone else's work:

  • Approve a workpaper, or return it for rework.
  • Verify-close a finding.
  • Verify or reject a remediation action.
  • Move the engagement through its lifecycle: start fieldwork, move to draft report, send for management review, issue the final report.
  • Generate the structured report.

Closing or cancelling an engagement, issuing and finalising the report, and approving the annual plan are manager acts. A lead auditor cannot do them.

Who does what — at a glance​

ActionAuditorReviewerLead AuditorManager
Read the engagement✓✓✓✓
Edit workpapers, evidence, review notes✓✓✓✓
Create workpapers and evidence requests✓✓✓✓
Raise a finding from an exception✓✓✓✓
Submit a workpaper for review✓✓✓✓
Approve or return a workpaper✓✓✓
Verify-close a finding✓✓✓
Verify or reject a remediation action✓✓✓
Move the engagement lifecycle✓✓✓
Add or remove team members✓✓
Close or cancel the engagement✓
Issue and finalise the report✓

Observers and people not on the team have only the first row.

The Lead auditor field​

The engagement's Lead auditor field, set when the engagement is created or on the Overview tab, counts as a lead auditor team role even without a row in the team list. Naming someone as lead is enough for them to start assigning the team.

Segregation of duties still applies​

The team role decides who may review. Segregation of duties decides who may not review this particular item, and it wins:

  • A reviewer who submitted a workpaper cannot approve that workpaper, even though they can approve every other one on the engagement.
  • Whoever owns a remediation action cannot verify it.
  • The finding owner cannot verify-close their own finding.

If you are blocked with a message about segregation of duties, the answer is a second person, not a different role.

Auditees keep their own lane​

People outside the audit team who own something on the engagement can still act on that one thing without a team role:

  • The owner of a remediation action can update its progress and attach evidence.
  • The owner of a finding can post the management response.
  • The assignee of an evidence request can attach files and submit it.

They cannot accept their own request, verify their own action, or touch anything else on the engagement.

Assigning the team​

  1. Open the engagement and stay on the Overview tab.
  2. In the Team card, choose Add. Only managers and the engagement's lead auditor see this button.
  3. Pick the person and their team role, then add them.
  4. To change someone's role later, edit their row in the same card.

Assign the team before fieldwork starts. Until an analyst is on the team, they see the engagement read-only with a notice saying so, and the Create, Submit and Approve controls are hidden from them.

What the messages mean​

MessageCauseFix
You are not on this engagement's teamAnalyst opening an engagement they are not assigned to.A manager or the lead auditor adds them to the team.
Observers have read-only accessAssigned as observer.Change their team role to auditor or above.
This is a review actAn auditor tried to approve, return, verify or move the engagement.Have the reviewer or lead do it, or change the person's team role to reviewer.
Managing the engagement team requires the Lead Auditor roleA reviewer or auditor tried to change the team.The lead auditor or a manager manages the team.
Segregation of dutiesThe person did the work they are now trying to approve.A second person approves.

A worked example​

An audit function of five: a Chief Audit Executive, one audit manager, and three auditors.

  • The CAE and the manager hold the Manager organisation role. They never need team assignments.
  • The three auditors hold the Analyst organisation role.
  • On the IT Access Management engagement, the manager names Sara as lead auditor, adds Omar as auditor and Fatima as reviewer. Sara plans and assigns; Omar and Sara do fieldwork; Fatima and Sara approve workpapers and verify-close findings, except any they prepared themselves.
  • On the Procurement engagement running at the same time, Fatima is lead, Omar is again auditor, and Sara is only an observer because she is a former member of that department.

Nobody's organisation role changed between the two engagements. Only the team assignments did.