ITGC Workpaper — Meridian Financial Group

Restrictions on Use & Disclaimer

Limitation of Liability

This workpaper is provided on an “as-is” basis. The preparer makes no warranties, express or implied, regarding the completeness, accuracy, or fitness for any particular purpose of the information contained herein. In no event shall the preparer be liable for any direct, indirect, incidental, or consequential damages arising from the use of or reliance upon this workpaper.

Scope Limitation

The conclusions expressed in this workpaper are limited solely to the IT General Controls identified within the defined engagement scope. This workpaper does not constitute an audit opinion, assurance engagement, or attestation under any professional standard. The assessment does not extend to application controls, business process controls, or any controls outside the specifically enumerated scope.

Third-Party Reliance Prohibition

This workpaper is intended solely for the use of the named client and the engagement team identified on the cover sheet. No third party may rely upon the contents, conclusions, or recommendations herein without the prior written consent of the preparer. The preparer accepts no duty of care or liability to any third party who accesses this document.

AI Output Reliability

Portions of this workpaper were generated or assisted by artificial intelligence. AI-assisted test results, classifications, and analyses are subject to inherent limitations including, but not limited to, potential misinterpretation of source evidence, hallucinated references, and inconsistent confidence scoring. All AI-generated outputs have been subject to mandatory human review as documented in the testing results section. The preparer does not warrant the accuracy of any individual AI-generated output.

Authorized Recipients

Distribution of this workpaper is restricted to authorized recipients as determined by the engagement team. Unauthorized copying, distribution, or disclosure of this document or any portion thereof is strictly prohibited. Recipients must maintain appropriate access controls over this document consistent with its confidential classification.

Confidentiality & Data Handling

This workpaper may contain confidential business information, personally identifiable information, and proprietary system details. Recipients must maintain appropriate administrative, technical, and physical safeguards to protect the confidentiality of this document. Upon completion of the engagement or at the preparer’s request, all copies of this document must be securely destroyed or returned.

This disclaimer section should be reviewed by qualified legal counsel before reliance in a production audit engagement.

Table of Contents

Restrictions on Use & Disclaimer

1. Cover Sheet & Signatures

2. Executive Summary

3. Scope & Systems

4. Scope Gap Justifications

5. Controls Matrix

6. Population & Sampling Documentation

7. Testing Results by Control

8. Traceability (Change Controls)

13. Abbreviations & Glossary

2. Executive Summary 2

Ref (for reference only): AICPA AU-C 265, PCAOB AS 2201.62-70

Overall Opinion

EFFECTIVE WITH EXCEPTIONS

Based on our examination of 8 IT General Controls across 4 systems in scope, covering the period 1 Jan 2025 through 31 Dec 2025, we conclude that the entity’s IT General Controls are effective with exceptions. A total of 4 exceptions were identified during testing. Sampling was performed using random, judgmental selection methods with cryptographic seeding for reproducibility.

Controls Tested: 8

Clean Pass: 5 of 8 (63%)

Exceptions: 4 (0 critical)

QC Checks: 32 (28 passed)

8

Total Controls

5

Clean Pass

3

Pass w/ Exceptions

0

Failed

8

Signed Off

4

Exceptions

12,467

Population Items

185

Samples Tested

AI Technology Disclosure

This engagement utilized AI-assisted testing powered by Anthropic Claude language models. All AI-generated test results were subject to mandatory auditor review before acceptance. AI determinations that were rejected by the auditor are documented with override rationale. The use of AI does not diminish the auditor’s professional responsibility or judgment.

Ref: PCAOB Staff Guidance on Technology-Assisted Analysis in Auditing

Scope Memo:

This engagement covers IT General Controls supporting financial reporting for Meridian Financial Group’s FY2025 fiscal year. Testing scope includes access management, change management, IT operations, and security monitoring controls across four in-scope systems. Controls were selected based on risk assessment considering financial statement materiality, prior-year findings (none), and regulatory requirements under SOX Section 404. Reliance was placed on the managed service provider’s SOC 1 Type II report for restore testing, patch management, and monitoring controls.

3. Scope & Systems 3

Ref (for reference only): PCAOB AS 2110, AICPA AU-C 315

Areas in Scope: Access Change Operations Security

System Name	Type	Environment	Owner	Controls
Oracle EBS R12.2	Financial ERP	Production (eu-west-1)	IT Applications — David Park	3
Microsoft Entra ID	Identity & Access Management	Production (Global)	IT Security — Maria Santos	3
ServiceNow ITSM	IT Service Management	Production (SaaS)	IT Operations — James Liu	2
AWS (us-east-1)	Cloud Infrastructure	Production	Cloud Engineering — Anna Kowalski	3

4. Scope Gap Justifications 4

Ref (for reference only): PCAOB AS 2201.39-42, AICPA AU-C 530

The following scope gap justifications have been documented and approved by a Partner:

System	Control	Justification	Approved By
Entra ID	A3	Privileged access provisioning is managed through Entra ID Privileged Identity Management (PIM) with just-in-time elevation and automated expiration. Provisioning controls are covered under A1; periodic review under A6.	Sarah Chen, ACCA 15 Nov 2025
Entra ID	A4	Privileged access periodic review is performed through the same quarterly review cycle tested under A6. PIM assignments are time-bound (max 8 hours) and do not persist between sessions.	Sarah Chen, ACCA 15 Nov 2025
Entra ID	A5	Break-glass emergency access is managed through Entra ID PIM with time-bound assignments, MFA enforcement, and automated audit logging. No standing break-glass accounts exist in the environment.	Sarah Chen, ACCA 15 Nov 2025
AWS	A7	Service account lifecycle is automated through AWS IAM roles with programmatic credential rotation (90-day policy). No interactive service accounts exist — all workloads use assumed roles with session tokens.	Sarah Chen, ACCA 15 Nov 2025
Entra ID	A8	Authentication controls (MFA, conditional access, password complexity) are enforced at the identity provider level through Entra ID tenant-wide policies. Organizational-level IT controls outside ITGC testing scope per the agreed SOX 404 scoping framework.	Sarah Chen, ACCA 15 Nov 2025
ServiceNow	C2	Emergency change procedures follow the same approval workflow as normal changes (C1) with expedited CAB review (4 hours vs. standard 48 hours). Emergency changes are retroactively reviewed in weekly CAB meetings. Testing coverage provided under C1.	Sarah Chen, ACCA 15 Nov 2025
GitLab CI	C4	CI/CD pipeline security is enforced through GitLab CI with branch protection rules, mandatory merge request approvals, and automated SAST/DAST scanning. Pipeline configuration changes require senior engineer approval. Deployment controls tested under C3 (Release Controls).	Sarah Chen, ACCA 15 Nov 2025
AWS	C5	Infrastructure-as-code changes are managed through Terraform with mandatory plan review, state locking, and approval gates. IaC changes follow the same approval workflow tested under C1 (Normal Change Approvals).	Sarah Chen, ACCA 15 Nov 2025
AWS	O2	Restore testing is performed quarterly as part of backup validation under O1 (Backup Success Monitoring). Q3 2025 recovery test achieved RTO of 2h 47m vs. 4h target. Standalone restore testing control not required.	Sarah Chen, ACCA 15 Nov 2025
ServiceNow	O4	Monitoring and alert response is outsourced to Meridian’s managed service provider (Kyndryl) under SOC 1 Type II report (report period: Apr 2025 – Mar 2026). Reliance placed on service organization controls per AICPA AT-C 320.	Sarah Chen, ACCA 15 Nov 2025
ServiceNow	O5	Incident management is handled through ServiceNow ITSM with automated SLA escalation. Financial system incidents (P1/P2) are escalated to IT Security within 15 minutes. Incident response does not directly impact financial reporting ITGC controls.	Sarah Chen, ACCA 15 Nov 2025
ServiceNow	O6	Problem management follows ITIL v4 framework through ServiceNow with automated root cause tracking. Problem records are linked to parent incidents and resolved through the normal change process (C1). No separate ITGC control required.	Sarah Chen, ACCA 15 Nov 2025
AWS	O7	Operating system and infrastructure patch management is outsourced to Kyndryl under SOC 1 Type II report (report period: Apr 2025 – Mar 2026). Reliance placed on service organization controls per AICPA AT-C 320.	Sarah Chen, ACCA 15 Nov 2025
AWS	O8	Audit log review is covered under S1 (Security Event Logging) which tests log coverage, retention, alerting configuration, and active monitoring across all in-scope systems. Separate audit log review control not required.	Sarah Chen, ACCA 15 Nov 2025
AWS	O9	DR/BCP testing is performed semi-annually by the infrastructure team. Last successful DR failover test: September 14, 2025 (RTO achieved: 2h 47m vs. 4h target). DR controls are organizational-level controls outside ITGC testing scope.	Sarah Chen, ACCA 15 Nov 2025
Oracle EBS	S2	Segregation of duties is enforced through Oracle EBS Advanced Access Controls with automated detection and preventive blocking. SOD conflicts in change management are tested under C3 (Release Controls) approval workflow. Application-level SOD is outside ITGC testing scope.	Sarah Chen, ACCA 15 Nov 2025
AWS	S3	Annual penetration testing performed by independent third party (NCC Group). Report dated August 18, 2025 reviewed — no critical or high findings affecting financial reporting systems. Ongoing vulnerability scanning managed through AWS Inspector with automated remediation tracking.	Sarah Chen, ACCA 15 Nov 2025
Entra ID	S4	Access review authorization is tested under A6 (User Access Reviews) which verifies reviewer authority, completion timeliness, and action on exceptions. Separate authorization control not required.	Sarah Chen, ACCA 15 Nov 2025

5. Controls Matrix 5

Ref (for reference only): PCAOB AS 2201.21-33, COSO Framework

Code	Control Name	Category	System	COSO Component	Status	Conclusion	Locked
A1	User Provisioning Approvals	Access	Entra ID	Control Activities (P10)	Pass	Pass	Signed Off
A2	User Terminations Timeliness	Access	Entra ID	Control Activities (P10)	Pass w/ Exceptions	Pass with Exceptions	Signed Off
A6	User Access Reviews (UAR)	Access	Oracle EBS	Monitoring (P16)	Pass	Pass	Signed Off
C1	Normal Change Approvals	Change	ServiceNow	Control Activities (P10)	Pass	Pass	Signed Off
C3	Release Controls	Change	Oracle EBS	Control Activities (P11)	Pass w/ Exceptions	Pass with Exceptions	Signed Off
O1	Backup Success Monitoring	Operations	AWS	Control Activities (P11)	Pass	Pass	Signed Off
O3	Batch Job Monitoring	Operations	Oracle EBS	Monitoring (P16)	Pass	Pass	Signed Off
S1	Security Event Logging	Security	AWS	Monitoring (P16)	Pass w/ Exceptions	Pass with Exceptions	Signed Off

Cross-references: Testing Results (§7) | Exceptions (§9) | QC Summary (§10)

6. Population & Sampling Documentation 6

Ref (for reference only): AICPA AU-C 530, PCAOB AS 2315

Control	Population Name	Source System	Total Count	Risk Level	AICPA Basis	Sample Method	Sample Size	Seed
A1	New User Accounts — Entra ID Provisioning Log FY2025	Entra ID	847	Medium	AU-C 530.A11 — Standard	random	25	a7f2c9...
A2	Terminated Users — HR Separation Report FY2025	Workday HRIS	156	High	AS 2315.18 — Extended	random	30	b3e8d1...
A6	Active User Accounts — Oracle EBS User Directory Q4 2025	Oracle EBS	2,341	Medium	AU-C 530.A11 — Standard	random	25	c4f7a2...
C1	Normal Change Tickets — ServiceNow FY2025	ServiceNow	1,287	Medium	AU-C 530.A11 — Standard	random	25	d9e1b5...
C3	Release Deployments — Oracle EBS + GitLab CI FY2025	GitLab CI	423	High	AS 2315.18 — Extended	random	30	e2f6c8...
O1	Scheduled Backup Jobs — AWS Backup FY2025	AWS Backup	365	Low	AU-C 530.A13 — Reduced	random	15	f1a3d7...
O3	Batch Job Executions — Oracle Concurrent Manager Q4 2025	Oracle EBS	4,892	Low	AU-C 530.A13 — Reduced	random	15	g5b9e4...
S1	Security Log Sources — AWS CloudTrail + GuardDuty FY2025	AWS	2,156	Medium	AU-C 530.A11 — Standard	judgmental	20	—

Note: All sampling uses cryptographic seeding for reproducibility. Random sampling uses SHA-256 derived seeds. Judgmental sampling (S1) uses auditor-selected items targeting critical financial system event sources.

Total: 12,467 population items, 185 samples tested.

7. Testing Results by Control 7

Ref (for reference only): AICPA AU-C 500, PCAOB AS 1105

Testing Methodology

Testing was performed using an Evidence-First approach: evidence documents are mapped to sample items and control attributes before AI-assisted analysis is executed. Each sample item is tested against all defined acceptance criteria (attributes) with results subject to mandatory auditor review.

Sampling: Per AICPA AU-C 530 / PCAOB AS 2315, samples were selected using random, judgmental selection methods with cryptographic seeding for full reproducibility. All seeds are documented in Section 6.

Risk Level	Sample Size (AICPA)	Basis
Low	5–15	Reduced testing, strong prior-year reliance
Medium	15–25	Standard testing, moderate reliance
High	25–40+	Extended testing, limited/no reliance

AI Disclosure: AI-assisted testing was performed using Anthropic Claude models. All AI results are subject to mandatory auditor review before acceptance. Confidence scores and auditor override status are documented in the AI Provenance section below each control.

Acceptance Criteria Summary

Control	Acceptance Criteria	Testing Complete	Evidence Mappings	Status
A1 User Provisioning Approvals	Request Documentation, Manager Approval, Timely Provisioning, Role Appropriateness	Yes	25 (25 samples)	pass
A2 User Terminations Timeliness	Timely Disable, Complete Disable, No Post-Termination Activity	Yes	30 (30 samples)	pass with exceptions
A6 User Access Reviews (UAR)	Coverage, Timely Completion, Action on Exceptions	Yes	25 (25 samples)	pass
C1 Normal Change Approvals	Change Request, Approval, Testing Evidence, Implementation Evidence	Yes	25 (25 samples)	pass
C3 Release Controls	Release Approval, Test Sign-off	Yes	30 (30 samples)	pass with exceptions
O1 Backup Success Monitoring	Backup Success, Failure Resolution	Yes	15 (15 samples)	pass
O3 Batch Job Monitoring	Job Success, Failure Handling	Yes	15 (15 samples)	pass
S1 Security Event Logging	Log Coverage, Log Retention, Alerting Configuration, Active Monitoring	Yes	20 (20 samples)	pass with exceptions

Note: All acceptance criteria must be met and evidenced for controls to receive a “Pass” status.

A1User Provisioning Approvals Signed Off

pass

System: Entra ID | Category: Access | Population: 847 | Samples: 25

Verify that new user accounts are provisioned with documented access requests, manager approval, timely setup, and appropriate role assignment.

CONCLUSION NARRATIVE:

Tested 25 new user provisioning requests from a population of 847 accounts created during FY2025. All sampled items had documented access requests with business justification (A1-1), manager approval prior to access grant (A1-2), provisioning within the 2-business-day SLA (A1-3), and role assignments consistent with the approved request (A1-4). No exceptions identified. Control is operating effectively.

ATTRIBUTE-LEVEL TESTING RESULTS:

Sample	A1-1: Request Documentation	A1-2: Manager Approval	A1-3: Timely Provisioning	A1-4: Role Appropriateness	Evidence
USR-2025-0012	✓	✓	✓	✓	1 file(s)
USR-2025-0047	✓	✓	✓	✓	1 file(s)
USR-2025-0103	✓	✓	✓	✓	1 file(s)
USR-2025-0219	✓	✓	✓	✓	1 file(s)
USR-2025-0384	✓	✓	✓	✓	1 file(s)

Showing 5 of 25 samples — all 25 pass on all attributes

Legend: ✓ Pass | ✗ Fail | ? Inconclusive | ... Pending | − Not Tested

AI TESTING PROVENANCE (Evidence-First):

Total AI Results: 100

Samples Tested: 25

Accepted: 99

Overridden: 1

Avg Confidence: 91%

<70%: 1

≥90%: 18

Sample	Attribute	AI Result	Confidence	Auditor	Rationale	Model
USR-2025-0012	A1-1: Request Documentation	PASS	94%	✓ Accepted	Access request form REQ-0012 contains business justification and role specification	claude-sonnet-4-5
USR-2025-0012	A1-2: Manager Approval	PASS	92%	✓ Accepted	Manager approval by J. Smith dated 2025-01-15, prior to provisioning date 2025-01-16	claude-sonnet-4-5
USR-2025-0012	A1-3: Timely Provisioning	PASS	88%	✓ Accepted	Account provisioned within 1 business day of approval (SLA: 2 days)	claude-sonnet-4-5
USR-2025-0012	A1-4: Role Appropriateness	PASS	90%	✓ Accepted	Assigned role “Financial Analyst” matches requested role in REQ-0012	claude-sonnet-4-5
USR-2025-0047	A1-1: Request Documentation	PASS	96%	✓ Accepted	ServiceNow ticket INC-4701 documents access request with department and role justification	claude-sonnet-4-5
USR-2025-0384	A1-3: Timely Provisioning	PASS	62%	✓ Override → PASS	AI confidence low due to ambiguous date format in evidence. Auditor verified provisioning within SLA via manual timestamp comparison.	claude-sonnet-4-5

Total: 100 AI test results (showing 6 of 100, incl. 1 low-confidence override)

Note: All AI test results require auditor review before conclusions can be locked (Evidence-First methodology).

A2User Terminations Timeliness Signed Off

pass with exceptions

System: Entra ID | Category: Access | Population: 156 | Samples: 30

Verify that terminated users have access disabled within the 24-hour SLA, all linked systems are fully deprovisioned, and no post-termination transactional activity occurred.

CONCLUSION NARRATIVE:

Tested 30 user terminations from a population of 156 HR separations during FY2025. 28 of 30 sampled items had timely access disable within the 24-hour SLA (A2-1). Two items had delayed access disable: EMP-2847 (12 business days — HRIS-to-IAM batch sync failure; remediated with real-time webhook) and EMP-1903 (3 business days — within risk tolerance, holiday period manual delay). All 30 items had complete disable across all linked systems (A2-2). No post-termination transactional activity detected for either delayed user (A2-3). Control is effective with exceptions — the delayed termination finding was remediated and compensating monitoring confirmed no unauthorized activity.

ATTRIBUTE-LEVEL TESTING RESULTS:

Sample	A2-1: Timely Disable	A2-2: Complete Disable	A2-3: No Post-Term Activity	Evidence
EMP-2025-0142	✓	✓	✓	1 file(s)
EMP-2025-0387	✓	✓	✓	1 file(s)
EMP-2025-0619	✓	✓	✓	1 file(s)
EMP-2025-0847	✗	✓	✓	2 file(s)
EMP-2025-1023	✓	✓	✓	1 file(s)

Showing 5 of 30 samples — 28 pass all attributes, 2 fail on Timely Disable

Legend: ✓ Pass | ✗ Fail | ? Inconclusive | ... Pending | − Not Tested

AI TESTING PROVENANCE (Evidence-First):

Total AI Results: 90

Samples Tested: 30

Accepted: 89

Overridden: 1

Avg Confidence: 89%

<70%: 0

≥90%: 12

Sample	Attribute	AI Result	Confidence	Auditor	Rationale	Model
EMP-2025-0142	A2-1: Timely Disable	PASS	91%	✓ Accepted	Entra ID account disabled 4 hours after HR separation date; within 24-hour SLA	claude-sonnet-4-5
EMP-2025-0142	A2-2: Complete Disable	PASS	93%	✓ Accepted	All linked systems (Entra ID, Oracle EBS, VPN) show disabled status as of termination date	claude-sonnet-4-5
EMP-2025-0387	A2-3: No Post-Term Activity	PASS	95%	✓ Accepted	No login attempts or transactional activity detected in any system after separation date	claude-sonnet-4-5
EMP-2025-0847	A2-1: Timely Disable	FAIL	88%	✗ Accepted as exception	Account remained active 12 business days post-separation; HRIS-to-IAM batch sync failure identified as root cause	claude-sonnet-4-5
EMP-2025-1023	A2-2: Complete Disable	PASS	90%	✓ Accepted	Deprovisioning workflow completed across all 3 linked systems within 2 hours of disable trigger	claude-sonnet-4-5

Total: 90 AI test results (showing 5 of 90)

Note: All AI test results require auditor review before conclusions can be locked (Evidence-First methodology).

EXCEPTIONS (1):

Delayed access disable for EMP-2847 — Entra ID account active 12 business days post-HR separation

High Remediated

A6User Access Reviews (UAR) Signed Off

pass

System: Oracle EBS | Category: Access | Population: 2,341 | Samples: 25

Verify that quarterly user access reviews are completed within the 90-day cycle, performed by appropriate managers, and that identified access modifications are executed within 5 business days.

CONCLUSION NARRATIVE:

Tested 25 user accounts from the Q4 2025 quarterly access review cycle (population of 2,341 active Oracle EBS users). All sampled items had completed reviews within the 90-day cycle (A6-1), reviews were performed by the appropriate department manager or delegate (A6-2), and identified access modifications were executed within 5 business days of review completion (A6-3). No exceptions identified. Control is operating effectively.

ATTRIBUTE-LEVEL TESTING RESULTS:

Sample	A6-1: Coverage	A6-2: Timely Completion	A6-3: Action on Exceptions	Evidence
UAR-Q4-0023	✓	✓	✓	1 file(s)
UAR-Q4-0156	✓	✓	✓	1 file(s)
UAR-Q4-0412	✓	✓	✓	1 file(s)
UAR-Q4-0789	✓	✓	✓	1 file(s)
UAR-Q4-1105	✓	✓	✓	1 file(s)

Showing 5 of 25 samples — all 25 pass on all attributes

Legend: ✓ Pass | ✗ Fail | ? Inconclusive | ... Pending | − Not Tested

AI TESTING PROVENANCE (Evidence-First):

Total AI Results: 75

Samples Tested: 25

Accepted: 75

Overridden: 0

Avg Confidence: 93%

<70%: 0

≥90%: 20

Sample	Attribute	AI Result	Confidence	Auditor	Rationale	Model
UAR-Q4-0023	A6-1: Coverage	PASS	94%	✓ Accepted	User included in Q4 review cycle; review completed on 2025-10-18, within 90-day window	claude-sonnet-4-5
UAR-Q4-0023	A6-2: Timely Completion	PASS	92%	✓ Accepted	Review completed by department manager R. Chen within 45 days of cycle start	claude-sonnet-4-5
UAR-Q4-0156	A6-3: Action on Exceptions	PASS	96%	✓ Accepted	Excess AP_INVOICE_ENTRY role removed within 3 business days of review finding	claude-sonnet-4-5
UAR-Q4-0789	A6-1: Coverage	PASS	91%	✓ Accepted	User account reviewed as part of Finance department quarterly cycle; sign-off documented	claude-sonnet-4-5
UAR-Q4-1105	A6-2: Timely Completion	PASS	93%	✓ Accepted	Review completed by delegate M. Patel (authorized by VP Operations) within 60-day window	claude-sonnet-4-5

Total: 75 AI test results (showing 5 of 75)

Note: All AI test results require auditor review before conclusions can be locked (Evidence-First methodology).

C1Normal Change Approvals Signed Off

pass

System: ServiceNow | Category: Change | Population: 1,287 | Samples: 25

Verify that normal changes have documented change requests, CAB approval prior to production, testing evidence, and implementation evidence with deployment logs.

CONCLUSION NARRATIVE:

Tested 25 normal change tickets from a population of 1,287 ServiceNow change requests during FY2025. All sampled items had documented change requests (C1-1), CAB approval prior to production implementation (C1-2), documented testing evidence (C1-3), and implementation evidence with deployment logs (C1-4). Complete change traceability chain verified for all samples. No exceptions identified. Control is operating effectively.

ATTRIBUTE-LEVEL TESTING RESULTS:

Sample	C1-1: Change Request	C1-2: Approval	C1-3: Testing Evidence	C1-4: Implementation Evidence	Evidence
CHG-2025-0034	✓	✓	✓	✓	2 file(s)
CHG-2025-0189	✓	✓	✓	✓	2 file(s)
CHG-2025-0456	✓	✓	✓	✓	1 file(s)
CHG-2025-0721	✓	✓	✓	✓	2 file(s)
CHG-2025-0998	✓	✓	✓	✓	1 file(s)

Showing 5 of 25 samples — all 25 pass on all attributes

Legend: ✓ Pass | ✗ Fail | ? Inconclusive | ... Pending | − Not Tested

AI TESTING PROVENANCE (Evidence-First):

Total AI Results: 100

Samples Tested: 25

Accepted: 100

Overridden: 0

Avg Confidence: 94%

<70%: 0

≥90%: 22

Sample	Attribute	AI Result	Confidence	Auditor	Rationale	Model
CHG-2025-0034	C1-1: Change Request	PASS	96%	✓ Accepted	ServiceNow CHG-0034 contains business justification, impact assessment, and rollback plan	claude-sonnet-4-5
CHG-2025-0034	C1-2: Approval	PASS	95%	✓ Accepted	CAB approval dated 2025-01-22 by Change Manager K. Williams, 3 days prior to implementation	claude-sonnet-4-5
CHG-2025-0189	C1-3: Testing Evidence	PASS	93%	✓ Accepted	UAT sign-off by business owner attached; test plan covers 12 scenarios with all passing	claude-sonnet-4-5
CHG-2025-0456	C1-4: Implementation Evidence	PASS	91%	✓ Accepted	Jenkins deployment log DEP-0456-PROD confirms successful production release at 2025-04-15 02:00 UTC	claude-sonnet-4-5
CHG-2025-0998	C1-1: Change Request	PASS	94%	✓ Accepted	Change request includes security review sign-off and infrastructure dependency mapping	claude-sonnet-4-5

Total: 100 AI test results (showing 5 of 100)

Note: All AI test results require auditor review before conclusions can be locked (Evidence-First methodology).

C3Release Controls Signed Off

pass with exceptions

System: Oracle EBS | Category: Change | Population: 423 | Samples: 30

Verify that production releases have documented release manager approval and test sign-off prior to deployment.

CONCLUSION NARRATIVE:

Tested 30 release deployments from a population of 423 Oracle EBS releases during FY2025. 27 of 30 sampled items had proper release approval and test sign-off. Three exceptions identified: (1) REL-2025-0847 — release deployed to production without documented approval from release manager; post-deployment review completed within 24 hours by senior developer as compensating control; accepted as risk. (2) REL-2025-1203 — test sign-off bypassed for release classified as ‘minor configuration’ that modified GL posting rules; CI/CD pipeline updated to enforce mandatory test sign-off for all Oracle EBS releases. (3) Sample #22 — AI initially flagged as FAIL for missing approval but auditor review confirmed compensating post-deployment validation was in place. Control is effective with exceptions — root causes addressed through process and tooling improvements.

ATTRIBUTE-LEVEL TESTING RESULTS:

Sample	C3-1: Release Approval	C3-2: Test Sign-off	Evidence
REL-2025-0102	✓	✓	2 file(s)
REL-2025-0399	✓	✓	1 file(s)
REL-2025-0615	✓	✓	2 file(s)
REL-2025-0847	✗	✗	1 file(s)
REL-2025-1203	✓	✗	1 file(s)

Showing 5 of 30 samples — 27 pass all attributes, 3 with exceptions

Legend: ✓ Pass | ✗ Fail | ? Inconclusive | ... Pending | − Not Tested

AI TESTING PROVENANCE (Evidence-First):

Total AI Results: 60

Samples Tested: 30

Accepted: 58

Overridden: 1

Avg Confidence: 92%

<70%: 0

≥90%: 16

Sample	Attribute	AI Result	Confidence	Auditor	Rationale	Model
REL-2025-0102	C3-1: Release Approval	PASS	95%	✓ Accepted	Release manager L. Torres approved deployment on 2025-01-18; approval timestamp precedes production push by 6 hours	claude-sonnet-4-5
REL-2025-0102	C3-2: Test Sign-off	PASS	93%	✓ Accepted	QA lead sign-off on test report TST-0102; 47 test cases executed with 100% pass rate	claude-sonnet-4-5
REL-2025-0847	C3-1: Release Approval	FAIL	89%	✗ Accepted as exception	No release approval found in ServiceNow or email; deployment initiated by developer without manager sign-off	claude-sonnet-4-5
REL-2025-1203	C3-2: Test Sign-off	FAIL	91%	✗ Accepted as exception	Release classified as “minor config” but modified GL posting rules; no test evidence attached	claude-sonnet-4-5
REL-2025-0615	C3-1: Release Approval	PASS	94%	✓ Accepted	CAB approval CAB-2025-05-22 with release manager and security team sign-off documented	claude-sonnet-4-5

Total: 60 AI test results (showing 5 of 60)

Note: All AI test results require auditor review before conclusions can be locked (Evidence-First methodology).

EXCEPTIONS (2):

Release REL-2025-0847 deployed to Oracle EBS production without documented release approval

High Accepted

Test sign-off bypassed for REL-2025-1203 — GL posting rules modified without documented test evidence

High Remediated

O1Backup Success Monitoring Signed Off

pass

System: AWS | Category: Operations | Population: 365 | Samples: 15

Verify that scheduled backups complete successfully and that any failures are detected and resolved within the 4-hour SLA through automated re-run or manual intervention.

CONCLUSION NARRATIVE:

Tested 15 scheduled backup jobs from a population of 365 daily AWS Backup executions during FY2025. All sampled items completed successfully (O1-1). Two sampled items had initial failures but documented resolution within the 4-hour SLA through automated re-run and alert acknowledgment (O1-2). No exceptions identified. Control is operating effectively.

ATTRIBUTE-LEVEL TESTING RESULTS:

Sample	O1-1: Backup Success	O1-2: Failure Resolution	Evidence
BKP-2025-0042	✓	✓	1 file(s)
BKP-2025-0118	✓	✓	1 file(s)
BKP-2025-0203	✓	✓	1 file(s)
BKP-2025-0287	✓	✓	2 file(s)
BKP-2025-0341	✓	✓	1 file(s)

Showing 5 of 15 samples — all 15 pass on all attributes

Legend: ✓ Pass | ✗ Fail | ? Inconclusive | ... Pending | − Not Tested

AI TESTING PROVENANCE (Evidence-First):

Total AI Results: 30

Samples Tested: 15

Accepted: 30

Overridden: 0

Avg Confidence: 96%

<70%: 0

≥90%: 14

Sample	Attribute	AI Result	Confidence	Auditor	Rationale	Model
BKP-2025-0042	O1-1: Backup Success	PASS	97%	✓ Accepted	AWS Backup job completed at 2025-02-12 03:15 UTC; vault recovery point verified with matching checksum	claude-sonnet-4-5
BKP-2025-0042	O1-2: Failure Resolution	PASS	95%	✓ Accepted	No failure detected for this backup job; successful on first attempt	claude-sonnet-4-5
BKP-2025-0287	O1-1: Backup Success	PASS	96%	✓ Accepted	Initial backup failed at 03:00 UTC; automated re-run succeeded at 03:45 UTC within 4-hour SLA	claude-sonnet-4-5
BKP-2025-0287	O1-2: Failure Resolution	PASS	98%	✓ Accepted	CloudWatch alarm triggered at 03:02 UTC; PagerDuty alert acknowledged by on-call engineer at 03:08 UTC	claude-sonnet-4-5
BKP-2025-0341	O1-1: Backup Success	PASS	97%	✓ Accepted	Full database snapshot completed in 42 minutes; restore test validated within same backup window	claude-sonnet-4-5

Total: 30 AI test results (showing 5 of 30)

Note: All AI test results require auditor review before conclusions can be locked (Evidence-First methodology).

O3Batch Job Monitoring Signed Off

pass

System: Oracle EBS | Category: Operations | Population: 4,892 | Samples: 15

Verify that batch jobs complete successfully with validated output and that failures trigger alerts with resolution within the 4-hour SLA.

CONCLUSION NARRATIVE:

Tested 15 batch job executions from a population of 4,892 Oracle Concurrent Manager jobs during Q4 2025. All sampled items either completed successfully with validated output (O3-1, 13 items) or had documented failure alerts with resolution within the 4-hour SLA (O3-2, 2 items — job IDs GLPOST-20251108 and ARAGING-20251203). Monitoring controls detected and escalated failures appropriately. No exceptions identified. Control is operating effectively.

ATTRIBUTE-LEVEL TESTING RESULTS:

Sample	O3-1: Job Success	O3-2: Failure Handling	Evidence
BATCH-2025-1108	✓	✓	1 file(s)
BATCH-2025-1427	✓	✓	1 file(s)
BATCH-2025-2003	✓	✓	1 file(s)
BATCH-2025-3156	✓	✓	2 file(s)
BATCH-2025-4201	✓	✓	1 file(s)

Showing 5 of 15 samples — all 15 pass on all attributes

Legend: ✓ Pass | ✗ Fail | ? Inconclusive | ... Pending | − Not Tested

AI TESTING PROVENANCE (Evidence-First):

Total AI Results: 30

Samples Tested: 15

Accepted: 30

Overridden: 0

Avg Confidence: 90%

<70%: 0

≥90%: 10

Sample	Attribute	AI Result	Confidence	Auditor	Rationale	Model
BATCH-2025-1108	O3-1: Job Success	PASS	92%	✓ Accepted	GL posting batch GLPOST-20251108 completed at 04:23 UTC; output reconciled with 847 journal entries posted	claude-sonnet-4-5
BATCH-2025-1108	O3-2: Failure Handling	PASS	88%	✓ Accepted	Initial failure at 03:00 UTC due to lock contention; OEM alert fired at 03:01 UTC, auto-retry succeeded at 04:23 UTC	claude-sonnet-4-5
BATCH-2025-1427	O3-1: Job Success	PASS	91%	✓ Accepted	AR aging report completed successfully; output file size consistent with expected record count	claude-sonnet-4-5
BATCH-2025-3156	O3-2: Failure Handling	PASS	90%	✓ Accepted	ARAGING-20251203 failed at 02:15 UTC; PagerDuty incident created at 02:16 UTC, DBA resolved within 45 minutes	claude-sonnet-4-5
BATCH-2025-4201	O3-1: Job Success	PASS	89%	✓ Accepted	Inventory valuation batch completed at 05:10 UTC; 12,483 items revalued with audit trail logged	claude-sonnet-4-5

Total: 30 AI test results (showing 5 of 30)

Note: All AI test results require auditor review before conclusions can be locked (Evidence-First methodology).

S1Security Event Logging Signed Off

pass

System: AWS | Category: Security | Population: 2,156 | Samples: 20

Verify that security event logs have complete coverage, meet the 365-day retention minimum, have proper alerting configuration, and are actively monitored through AWS Security Hub.

CONCLUSION NARRATIVE:

Tested 20 security log sources from a population of 2,156 AWS CloudTrail and GuardDuty log entries during FY2025 (judgmental selection targeting critical financial system event sources). All sampled items had complete log coverage (S1-1), proper alerting configuration (S1-3), and active monitoring through AWS Security Hub (S1-4). One item had a log retention policy of 90 days instead of the required 365-day minimum (S1-2) — S3 bucket lifecycle policy for the Oracle EBS CloudTrail log bucket was misconfigured during a cost optimization exercise. Retention policy corrected to 365 days on January 10, 2026, verified through bucket policy review. Control is effective with exceptions — the retention finding was an isolated configuration drift (remediated Jan 2026), not a systemic gap.

ATTRIBUTE-LEVEL TESTING RESULTS:

Sample	S1-1: Log Coverage	S1-2: Log Retention	S1-3: Alerting Configuration	S1-4: Active Monitoring	Evidence
LOG-2025-0014	✓	✓	✓	✓	1 file(s)
LOG-2025-0223	✓	✓	✓	✓	1 file(s)
LOG-2025-0567	✓	✓	✓	✓	1 file(s)
LOG-2025-0891	✓	✗	✓	✓	2 file(s)
LOG-2025-1456	✓	✓	✓	✓	1 file(s)

Showing 5 of 20 samples — 19 pass all attributes, 1 fail on Log Retention

Legend: ✓ Pass | ✗ Fail | ? Inconclusive | ... Pending | − Not Tested

AI TESTING PROVENANCE (Evidence-First):

Total AI Results: 80

Samples Tested: 20

Accepted: 80

Overridden: 0

Avg Confidence: 88%

<70%: 0

≥90%: 8

Sample	Attribute	AI Result	Confidence	Auditor	Rationale	Model
LOG-2025-0014	S1-1: Log Coverage	PASS	90%	✓ Accepted	CloudTrail logging enabled for all API calls; management and data events both captured for Entra ID integration	claude-sonnet-4-5
LOG-2025-0014	S1-3: Alerting Configuration	PASS	87%	✓ Accepted	GuardDuty findings routed to SNS topic with PagerDuty integration; escalation policy verified	claude-sonnet-4-5
LOG-2025-0567	S1-4: Active Monitoring	PASS	85%	✓ Accepted	Security Hub dashboard shows active monitoring; 14 findings triaged in past 30 days with documented resolution	claude-sonnet-4-5
LOG-2025-0891	S1-2: Log Retention	FAIL	92%	✗ Accepted as exception	S3 lifecycle policy shows 90-day expiration for Oracle EBS CloudTrail bucket; below 365-day minimum requirement	claude-sonnet-4-5
LOG-2025-1456	S1-1: Log Coverage	PASS	89%	✓ Accepted	VPC Flow Logs enabled for all production subnets; CloudWatch Logs group configured with cross-account access	claude-sonnet-4-5

Total: 80 AI test results (showing 5 of 80)

Note: All AI test results require auditor review before conclusions can be locked (Evidence-First methodology).

EXCEPTIONS (1):

CloudTrail log retention for Oracle EBS audit trail reduced to 90 days — below 365-day minimum

Medium Remediated

8. Traceability (Change Controls) 8

Ref (for reference only): PCAOB AS 2201.34-38, COBIT DSS06

Traceability chains apply to Change Management controls only (C1, C3). Each chain traces a change through 5 nodes: Ticket → Approval → Testing → Deployment → Closure.

C1Normal Change Approvals

Pass

25 of 25 samples have complete traceability chains

Sample	Ticket	Approval	Testing	Deployment	Closure	Status
CHG-2025-0412	✓ CHG-2025-0412	✓ CAB-2025-02-14	✓ TST-0412-R1	✓ DEP-0412-PROD	✓ 2025-02-18	Complete
CHG-2025-0891	✓ CHG-2025-0891	✓ CAB-2025-04-22	✓ TST-0891-R1	✓ DEP-0891-PROD	✓ 2025-04-25	Complete
CHG-2025-1156	✓ CHG-2025-1156	✓ CAB-2025-08-11	✓ TST-1156-R2	✓ DEP-1156-PROD	✓ 2025-08-14	Complete

Showing 3 of 25 samples — all 25 have complete 5-node chains

C3Release Controls

Pass w/ Exceptions

27 of 30 samples have complete traceability chains

Sample	Ticket	Approval	Testing	Deployment	Closure	Status
REL-2025-0847	✓ REL-2025-0847	✗ Missing	✓ TST-0847	✓ DEP-0847	✓ 2025-06-12	Incomplete
REL-2025-1203	✓ REL-2025-1203	✓ CAB-2025-09-05	✗ Missing	✓ DEP-1203	✓ 2025-09-08	Incomplete
REL-2025-2956	✓ REL-2025-2956	✓ Post-review	✓ TST-2956	✓ DEP-2956	✓ 2025-11-20	Complete (Override)

Showing 3 of 30 samples — 27 complete, 3 incomplete (2 missing nodes, 1 auditor override)

Note: The traceability chain ensures each change can be traced from initial request through approval, testing, deployment, and closure. Incomplete chains indicate potential control gaps that are documented as exceptions.

9. Exception Summary 9

Ref (for reference only): AICPA AU-C 265.07-08, PCAOB AS 2201.62-70 — See Testing Results

4

Total

0

Open

0

Critical

2

High

By category: access: 1, change: 2, security: 1.

4 exceptions were auto-created from accepted AI test failures. 2 remediated. 1 accepted as risk. 1 remediated (test sign-off bypass).

Control	Title	Severity	Status	Root Cause	Remediation	Raised
A2 AI	Delayed access disable for EMP-2847 — Entra ID account active 12 business days post-HR separation	High	Remediated	HRIS-to-IAM batch sync failure on Oct 3, 2025 — Workday API schema change caused silent failure	Real-time webhook deployed Nov 15, 2025; Datadog sync alert added	5 Dec 2025 Closed: 15 Jan 2026
C3 AI	Release REL-2025-0847 deployed to Oracle EBS production without documented release approval	High	Accepted	Release manager on leave; developer had legacy “Release Deployer” role enabling self-deployment	Risk accepted; post-deployment review within 24h; GitLab CI approval rules updated	5 Dec 2025
C3 AI	Test sign-off bypassed for REL-2025-1203 — GL posting rules modified without documented test evidence	High	Remediated	Release classified as “minor config” bypassed mandatory test gate despite modifying GL posting rules	CI/CD pipeline updated to enforce mandatory test sign-off for all Oracle EBS releases regardless of classification	5 Dec 2025 Closed: 20 Jan 2026
S1 AI	CloudTrail log retention for Oracle EBS audit trail reduced to 90 days — below 365-day minimum	Medium	Remediated	S3 lifecycle policy modified during cost optimization sprint in Aug 2025	Policy restored to 365 days 10 Jan 2026; AWS Config drift rule deployed	5 Dec 2025 Closed: 15 Jan 2026

10. QC Summary 10

Ref (for reference only): PCAOB AS 1220, AICPA QC 10

32

Total Checks

28

Passed

3

Failed

1

Warning

88%

Pass Rate

Pass rate excludes N/A checks from denominator.

Control	Total Checks	Passed	Failed	Pass Rate
A1	4	4	0	100%
A2	4	3	1	75%
A6	4	4	0	100%
C1	4	4	0	100%
C3	4	1	2	25%
O1	4	4	0	100%
O3	4	4	0	100%
S1	4	4	0	100%

Detailed Check Results (Non-Pass Only)

Control	Check Type	Check Name	Severity	Result	Acknowledgment
A2	post_termination_activity	Post-Termination Activity	Critical	Fail	✓ Acknowledged: “Finding confirmed. EMP-2847 had active Entra ID account for 12 business days post-termination. No transactional activity detected during delay period. Root cause: HRIS sync batch failure. Remediated — see Exception #1.”
C3	missing_approval	Missing Approval	High	Fail	✓ Acknowledged: “Release REL-2025-0847 deployed without documented release manager approval. Compensating control (24-hour post-deployment independent review) verified. GitLab CI approval rules updated — see Exception #2.”
C3	self_approval	Self-Approval	Critical	Fail	✗ Disputed: “QC check flagged REL-2025-1203 as self-approval, but the developer did not approve the release — they bypassed the test sign-off requirement, which is a C3-2 failure, not C3-1. The C3 test sign-off bypass was documented as a process gap in the C3 narrative.”
C3	date_sequence	Approval After Grant	High	Warn	✓ Acknowledged: “2 of 30 release deployment timestamps preceded final approval timestamps by 1–3 minutes. After timezone normalization (UTC vs CET), all deployments occurred after approval. Timestamp display issue only.”

11. Audit Trail 11

Ref (for reference only): PCAOB AS 1215, AICPA AU-C 230

Engagement Created

Sarah Chen, ACCA

FY2025 SOX 404 ITGC Assessment

15 Nov 2025 09:12 UTC

Scope Gap Justified

Sarah Chen, ACCA

18 controls documented as out of scope

15 Nov 2025 10:45 UTC

Population Uploaded

Sarah Chen, ACCA

A1: Entra ID Provisioning Log (847 items)

18 Nov 2025 14:20 UTC

Population Uploaded

Sarah Chen, ACCA

A2: HR Separation Report (156 items)

18 Nov 2025 14:22 UTC

Population Uploaded

Sarah Chen, ACCA

A6: Oracle EBS Users (2,341 items)

18 Nov 2025 14:25 UTC

Population Uploaded

Sarah Chen, ACCA

C1: ServiceNow Changes (1,287 items)

19 Nov 2025 09:30 UTC

Population Uploaded

Sarah Chen, ACCA

C3: Release Deployments (423 items)

19 Nov 2025 09:32 UTC

Population Uploaded

Sarah Chen, ACCA

O1, O3, S1 (3 populations)

19 Nov 2025 09:40 UTC

Sampling Run Generated

Sarah Chen, ACCA

8 runs — Method: random(7)/judgmental(1)

20 Nov 2025 11:15 UTC

Evidence Uploaded

Sarah Chen, ACCA

22 evidence files (32.8 MB total)

2 Dec 2025 16:45 UTC

AI Tests Executed

Sarah Chen, ACCA

8 controls, 185 samples

5 Dec 2025 10:30 UTC

AI Results Accepted

Sarah Chen, ACCA

182 accepted, 3 overridden

5 Dec 2025 14:20 UTC

Exception Raised

Sarah Chen, ACCA

A2: Delayed disable EMP-2847 (High)

5 Dec 2025 14:35 UTC

Exception Raised

Sarah Chen, ACCA

C3: Missing approval REL-2025-0847 (High)

5 Dec 2025 14:38 UTC

Exception Raised

Sarah Chen, ACCA

S1: Log retention below minimum (Medium)

5 Dec 2025 14:42 UTC

Exception Updated

Sarah Chen, ACCA

A2 #1 → Remediated

15 Jan 2026 11:00 UTC

Exception Updated

Sarah Chen, ACCA

S1 #3 → Remediated

15 Jan 2026 11:05 UTC

QC Checks Executed

Sarah Chen, ACCA

Rules: 32 | Passed: 28 | Failed: 3

20 Jan 2026 09:15 UTC

QC Finding Acknowledged

Sarah Chen, ACCA

A2: post_termination_activity

20 Jan 2026 09:30 UTC

QC Finding Acknowledged

Sarah Chen, ACCA

C3: missing_approval

20 Jan 2026 09:32 UTC

Testing Completed

Sarah Chen, ACCA

8 controls signed off

1 Feb 2026 15:00 UTC

Engagement Finalized

Sarah Chen, ACCA

Status: review → finalized

7 Feb 2026 14:30 UTC

22 material events of 266 total audit entries

Additionally: 47 conclusion updates, 185 evidence mappings, 12 other routine events recorded.

12. Evidence Index 12

Ref (for reference only): PCAOB AS 1215.04, AICPA AU-C 500

Evidence Sufficiency: 185 of 185 samples have mapped evidence (100%).

#	File Name	Type	Size	SHA-256	Controls
1	Entra_ID_Provisioning_Audit_Log_FY2025.csv	CSV	2.4 MB	a7f2c9e4...	A1 A2
2	Workday_HR_Separation_Report_FY2025.xlsx	Excel	847 KB	b3e8d1f7...	A2
3	Entra_ID_User_Account_Status_Export_Oct2025.pdf	PDF	1.1 MB	c4f7a2b9...	A2
4	Oracle_EBS_Active_Users_Q4_2025.csv	CSV	3.8 MB	d9e1b5c3...	A6
5	Oracle_EBS_Access_Review_Completion_Q4_2025.pdf	PDF	2.1 MB	e2f6c8a1...	A6
6	ServiceNow_Change_Tickets_FY2025.csv	CSV	5.2 MB	f1a3d7e4...	C1
7	ServiceNow_CAB_Meeting_Minutes_Sample.pdf	PDF	890 KB	g5b9e4f2...	C1
8	GitLab_CI_Release_Deployment_Log_FY2025.csv	CSV	1.7 MB	h8c2a6d1...	C3
9	Oracle_EBS_Release_Deployment_Audit_Trail.pdf	PDF	3.2 MB	j4e7b3f9...	C3
10	ServiceNow_Work_Notes_REL-2025-0847.pdf	PDF	245 KB	k9f1c5a8...	C3
11	GitLab_CI_Approval_Rules_Update_Dec2025.png	PNG	198 KB	m2d8e6b4...	C3
12	AWS_Backup_Vault_Inventory_FY2025.csv	CSV	1.3 MB	n7a3f9c1...	O1
13	AWS_Backup_Recovery_Test_Q3_2025.pdf	PDF	567 KB	p5b2d4e8...	O1
14	Oracle_Concurrent_Manager_Job_Log_Q4_2025.csv	CSV	8.4 MB	q1c6a7f3...	O3
15	Oracle_Batch_Failure_Alert_GLPOST_20251108.png	PNG	342 KB	r8e4b9d2...	O3
16	Oracle_Batch_Resolution_ARAGING_20251203.pdf	PDF	156 KB	s3f7c1a6...	O3
17	AWS_CloudTrail_Log_Sources_Inventory_FY2025.csv	CSV	4.1 MB	t6d2e8b5...	S1
18	AWS_S3_Lifecycle_Policy_Correction_Jan2026.pdf	PDF	423 KB	u9a4f3c7...	S1
19	Datadog_HRIS_Sync_Alert_Configuration.png	PNG	287 KB	v2b8d6e1...	A2
20	Workday_Webhook_Integration_Deployment.pdf	PDF	178 KB	w5c1a9f4...	A2
21	AWS_Config_Retention_Drift_Rule.png	PNG	312 KB	x8e3b7d2...	S1
22	GitLab_CI_Oracle_EBS_Approval_Gate_Config.pdf	PDF	234 KB	y1f6c4a9...	C3

Total: 22 files | 32.8 MB

Note: Evidence files are managed within the engagement platform with role-based access controls. SHA-256 hashes are computed at upload for integrity verification.

13. Abbreviations & Glossary 13

Standard terminology used throughout this workpaper

Abbreviation	Definition
AICPA	American Institute of Certified Public Accountants
BCP	Business Continuity Plan
CAB	Change Advisory Board
COBIT	Control Objectives for Information and Related Technologies
COSO	Committee of Sponsoring Organizations (2013 Framework)
DAST	Dynamic Application Security Testing
DR	Disaster Recovery
EQCR	Engagement Quality Control Review
IaC	Infrastructure as Code
ITGC	IT General Controls
MFA	Multi-Factor Authentication
PCAOB	Public Company Accounting Oversight Board
PIM	Privileged Identity Management
QC	Quality Control
RTO	Recovery Time Objective
SAST	Static Application Security Testing
SHA-256	Secure Hash Algorithm (256-bit)
SLA	Service Level Agreement
SNS	Simple Notification Service (AWS)
SOD	Segregation of Duties
SOX	Sarbanes-Oxley Act
TDR	Tolerable Deviation Rate
UAR	User Access Review
VPC	Virtual Private Cloud (AWS)