Start/Closure Notices
These are the three parts that make up Business Unit Management.
What are the Control Attestor, Control Owner and Activity Owner?
This is the number of Business Days for Management to respond to a follow-up request.
What is 2 BDs?
This is the control type that can automatically use a Limited Walkthrough.
What are Enterprise Wide Controls (EWCs)?
This is the type of Sampling most commonly used during ICFR USBP Testing.
What is Random?
Findings are issued a rating of Critical High, Medium, Low and this.
What is High?
The issuer of the final Closure Notices.
Who is SOX OG?
These are the two CRA categories that trigger an automatic overall rating of High.
What are #8 - Control Intended to Prevent/Detect Fraud and #9 - Impact of Prior Year Findings?
This is the number of transactions that are documented during a standard WT.
What is 1?
This is the internal system used to obtain a random sample.
What is Alteryx?
This is the number of Calendar Days Management has to submit an Action Plan.
What is 30?
Scope period, estimated start date, estimated exit date and this are the required communications on a Start Notice.
What is the SOX control?
What is Support Validation?
This is the conclusion for a control with proper design, but improvements are identified.
What is Effective?
When obtaining Q3/Q4 coverage, this uncommon type of sampling is permitted.
What is Judgmental?
This is the lowest level that can perform an L1 for a Finding Grid from the Current Year.
What is AM2 (or L10)?
All key stakeholders included on the Closure Notice are the same as Start Notices, except this, for High Risk Findings.
Who is the Business Unit SVP?
STOP: This must be used because the Line of Business is providing PII.
What is the FTP?
A control assessed at Low Risk, No PY findings, but a different team member at the same level is performing the control means this type of WT can be performed.
What is Limited?
This is the time period for Fiscal Q3.
What is May 1 - July 31?
Low Risk Findings can be closed via this, with approval from the ICFR AVP.
What is management's assertion?
This is the amount of business days ICFR has to issue a start notice on a newly scoped in control.
What is no requirement?
These are the Standards used to Design Test Scripts.
What are Operational Audit?
This is the number of Control Design Evaluation Criteria.
What is 8?
A high risk control performed ad hoc requires 21 samples and this many reperformance samples.
What is 5?
Updating the scope or this can result in a SOX rating residual risk change.
What is Materiality?