How do we rate a control deficiency and set its deadline?

Start

A reviewer has signed a workpaper that found a problem

The control assurance lead rates each deficiency when the reviewer signs the workpaper. The date the reviewer signs is the day the deficiency is confirmed, and every deadline counts from it.

• Then: Was the design Deficient, or the operating test Not effective?

Decision

Was the design Deficient, or the operating test Not effective?

Every design deficiency and every Not effective result is a deficiency. An exception found on a test that was still concluded Effective, after the sample was extended, is not one.

• Yes: Log it the day the reviewer signs, with what was found
• No, Effective with an exception: Not a deficiency: note the exception and keep testing on cycle

Outcome

Not a deficiency: note the exception and keep testing on cycle

Record the exception in your tracker's list of exceptions noted, with the control that caught it if one did. It needs no plan or deadline of its own.

Step

Log it the day the reviewer signs, with what was found

Enter the control, the workpaper, whether the deficiency is in design or operation, and the finding in one or two sentences. Enter the date the reviewer confirmed it: the plan-by and due dates count from it.

• Then: Did it run every time, with only its record short of the standard?

Decision

Did it run every time, with only its record short of the standard?

This is checked first. A control that ran, with a record short of the evidence standard, such as approvals with no date, is Low whatever else applies. A control that did not run is never Low. If you are not sure it ran, take the cautious branch.

• Yes: Rate it Low: fixed within 365 days
• No, or not known: Is it a key control?

Step

Rate it Low: fixed within 365 days

The control ran, but its record falls short of the evidence standard. In the pack's default a Low deficiency is fixed within 365 days of the day the reviewer signed.

• Then: Tell the risk owner now; agree a plan within 10 working days

Decision

Is it a key control?

A control is key when its failure alone would let a risk on the register happen or go unnoticed, or when the organisation names it as its evidence for an obligation. Your control inventory should say so. If it does not, take the cautious branch.

• Yes, or not known: Was a control keeping the same risk in check tested Effective?
• No: Does a risk outside appetite or an unmet obligation rely on it?

Decision

Does a risk outside appetite or an unmet obligation rely on it?

A control that is not key can still matter: if its failure leaves a risk outside appetite, or an obligation you have recorded as not met, without its control, it is rated as a key control would be. If you do not know, take the cautious branch.

• Yes, or not known: Was a control keeping the same risk in check tested Effective?
• No: Rate it Medium: fixed within 180 days

Decision

Was a control keeping the same risk in check tested Effective?

A compensating control keeps the same risk in check when this one fails, such as a monthly account reconciliation behind a leaver control. It counts only once it has itself been tested and found effective for the same period. One that is believed to work but has not been tested does not count. Name it on the deficiency with the workpaper that tested it.

• Yes: Rate it Medium: fixed within 180 days
• No, or not known: Rate it High: fixed within 90 days

Step

Rate it High: fixed within 90 days

A key control failed with nothing tested behind it, or the failure leaves a risk outside appetite or a recorded unmet obligation without its control. In the pack's default a High deficiency is fixed within 90 days of the day the reviewer signed.

• Then: Tell the risk owner now; agree a plan within 10 working days

Step

Rate it Medium: fixed within 180 days

A compensating control was tested effective behind a key control, or behind a control that a risk outside appetite or a recorded unmet obligation rests on. Or a control that is not key failed and neither rests on it. In the pack's default a Medium deficiency is fixed within 180 days of the day the reviewer signed.

• Then: Tell the risk owner now; agree a plan within 10 working days

Step

Tell the risk owner now; agree a plan within 10 working days

Deadlines are calendar days. The risk owner of every risk that relies on the control is told the same day, and decides whether the risk needs reassessing. The control owner agrees what will change, who does it, by when, and the record that will show the fix; the Head of Information Security agrees it for a security control. Where planned work will fix it, link that work, due no later than the deficiency. Rate the control Higher until a retest passes. If no plan is agreed in time, the lead takes it to the assurance sponsor.

• Then: Is it rated High?

Decision

Is it rated High?

A High deficiency goes higher than the control owner. Medium and Low deficiencies are reported in the quarterly counts, and named if they pass their due date.

• Yes: Report it to the sponsor and the approver in the next report
• No: Will the fix be in place by the due date?

Step

Report it to the sponsor and the approver in the next report

The approver is the one your governance sets: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. The approver accepts any risk left while the deficiency stays open.

• Then: Will the fix be in place by the due date?

Decision

Will the fix be in place by the due date?

A deficiency is fixed by its due date or deferred. It is never deferred by changing the due date in the tracker. If the owner cannot say the fix will be ready in time, take the cautious branch while there is still time to ask.

• Yes: Once fixed, wait until the control has run at least twice
• No, or not known: Request a security exception before the due date passes

Outcome

Request a security exception before the due date passes

The owner asks for an exception naming the deficiency, why the fix is late, what keeps the risk in check meanwhile, and the new date. The approver its band sets decides, never the assurance lead or the owner alone. Without an approved exception the deficiency is overdue, named in the next report, and the assurance sponsor decides on a High one.

Step

Once fixed, wait until the control has run at least twice

The owner's statement that it is fixed starts the retest; it never closes the deficiency. The retest waits until the fixed control has run at least twice, or once for an annual or automated control, in the pack's default. A design deficiency is retested with a new walkthrough first. A deficiency fixed by its due date and waiting for its retest is still open, but it is not past due.

• Then: Did a retest by someone other than the owner pass?

Decision

Did a retest by someone other than the owner pass?

The retest is an operating test on its own workpaper, over a period that starts after the fix, with the same sample table and a reviewer's signature.

• Yes: Close it with the retest workpaper and the reviewer's date
• No: Keep it open with its original due date and agree a new plan

Outcome

Close it with the retest workpaper and the reviewer's date

The control's rating returns to what its risk and key status set. A closed deficiency means a retest passed. It is not an audit finding closed, and not evidence of compliance.

Outcome

Keep it open with its original due date and agree a new plan

A failed retest keeps the deficiency open, and the next report shows it. Agree a new plan and tell the risk owner again. The due date stays unless an approved security exception moves it. If that date has passed with no approved exception, the deficiency is past due and named in the next report.