CORAA

VAPT Scope and Retest Tracker (Word)

Define the scope and rules of engagement for a penetration test and track findings through fix and retest.

Free · CORAA original — SA-aligned
Updated 17 Oct 2026
Defines
Scope and rules
Tracks
Findings to retest
Closes on
Retest result
Format
Editable Word
Share this template
Your firm — letterhead
Appears at the top of the document as the audit firm letterhead.
Used as the letterhead block.
Engagement details
The client and period this document is for.
What’s inside

An excerpt from the template.

VAPT Scope and Retest Tracker — ___

Scope / period: ___ | Prepared by: ___ | Reviewed by: ___ | Date: ___

Vulnerability assessment and penetration testing is done by a qualified tester. This form helps the company define the scope, rules of engagement and follow-up, and helps an auditor check that findings were fixed and retested.

1. Scope and rules of engagement

↑ Excerpt only — the full template is what you download as Word
About this template

What you’re downloading, and when to use it.

This template follows the format published by the Institute of Chartered Accountants of India (ICAI) in the AASB Audit Working Paper Templates (June 2023), the authoritative reference for Indian statutory-audit documentation. Fill in your firm’s letterhead and the engagement details on the form above, click Download Word file, and you’ll get a fully formatted .docx ready to use.

Everything is generated in your browser and on a stateless API endpoint — no account, nothing stored on our servers. We’ll ask for a work email once before your first download so we can send you the file and the occasional relevant update; after that, downloads on this device are instant. Edit freely in Word, Google Docs or Pages before sending to your client.

Common questions

FAQs.

Who should do VAPT?
A qualified tester with written authorisation from the system owner. The company and its auditor then track fixes and retest results.
Related templates

You might also need.

Cybersecurity Internal Audit Checklist
Free cybersecurity internal audit checklist. Vulnerability management, incident response, security awareness,
SOX Control Test Workpaper — Design and Operating Effectiveness
Generate a SOX control test workpaper covering walkthrough, design effectiveness, operating effectiveness samp
Risk Register Template
Generate a risk register template with likelihood and impact scoring, inherent and residual risk, controls, ow