During the planning phase of an assessment, it is not necessary to conduct a complete risk assessment and detailed testing. Instead, limited information gathering and initial procedures are sufficient to estimate inherent risk and control risk, allowing planning to proceed. This initial estimate helps to set the scope and focus of the assessment. Detailed testing and a comprehensive risk assessment can be conducted during the actual assessment phase. This approach allows for a more efficient and flexible planning process.References:
* ISO 19011:2018 - Guidelines for auditing management systems
* NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments