The Scope Definition phase of the audit should not result in a list of procedures but help identify potential systemic barriers, how it might impact the business, and whether the internal controls will provide reasonable assurance that unconscious bias will be avoided, prevented, or detected. The five core areas are: Race, Gender, Disability, Age and Sexual Orientation .

Once scope has been defined, we then carry out an asset analysis that comprise of the following:
1. Determine available assets including human assets, product assets, procurement/partnership assets, internal processes/procedures
2. For each asset category, identify end-to-end processes, procedures, decision points and key decision makers
3. For each asset category/end-to-end process, identify possible diversity and racial equity barriers and weaknesses in the processes.

During our asset analysis, we identify and document controls that may detect systemic diversity and racial equity barriers, risks, and weaknesses current in place. This helps us to identify the checks and balances in processes and procedures that ensure non-bias operations. These controls are matched to the systemic barriers, risks and weaknesses identified earlier. Any gaps found are documented. Some examples of preventative or detective controls include:
• Segregating conflicting duties (preventative)
• Capturing of Race, Ethnicity and Language (ReAL) data (detective)
• Enabling anonymous complaints / Whistleblower hotline (detective)
• Periodic review of compliance (detective).

Testing the controls identified earlier ensures that the safeguards put in place to identify or prevent bias operations are working properly. The overall objective this type of testing is threefold:
1. Ensures that the process or test procedures as outlined are an effective method for testing the diversity and racial equity controls
2. Diversity and racial equity controls are being performed throughout the entire audit period and by the assigned process owner
3. The controls have been successful in preventing or detecting any systemic diversity and racial equity barriers, risks, and weaknesses
Diversity and racial equity control testing validates the operating effectiveness of the methods put in place by organizations to dismantle systemic racial barriers .

Ongoing investment in our diversity and racial equity program should result in an improvement in actions, policies, and procedures that eliminates systemic barriers due to race, gender, age, disability, or sexual orientation. As the environment improves, businesses should also see a clear increase in the level of diversity, equity, and inclusion within its workforce, especially in the racial equity area.
Not all barriers, risks and weaknesses are created equal. When assessing gaps identified, we categorize them into three different areas: high, medium, low based on their level of impact. We focus our initial recommendations on the high and medium impact gaps .