According to IIA guidance, a draft work program prepared by the engagement supervisor after concluding a preliminary assessment would test the process controls. The work program outlines the specific procedures and steps the internal audit team will take to evaluate the effectiveness of the controls in place to mitigate identified risks.
References:
* IIA Standards: 2240 - Engagement Work Program
* IIA Practice Guide: Engagement Planning

Discovery sampling is typically used when an internal auditor wants to test a large sample for fraud. This technique is particularly effective for identifying instances of fraud or other irregularities in a population. Discovery sampling is designed to detect at least one occurrence of an attribute, such as fraud, within the sampled population if it exists. It is particularly useful when the occurrence rate of the fraud is expected to be low.
Reference:
IIA Practice Guide: Sampling in Internal Auditing
IIA Standards: 2320 - Analysis and Evaluation

Section: Volume E