1.4.3. Financial Assurance Control Testing

(1) The CFO and Deputy CFO are responsible for executing OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, Appendix A: Management of Reporting and Data Integrity Risk requirements to support Treasury’s assurance statement by properly identifying, testing, and evaluating the IRS’s controls over data integrity and financial reporting.

(1) The Associate CFO for Internal Controls is responsible for:

1. Overseeing the FACT process including approving final test plans.

2. Administering the governance process by chairing the FACT Technical Review Board, providing the status and results of FACT activities to the Management Controls Executive Steering Committee (MC ESC) and the FACT Technical Review Board, and documenting key decisions.

(1) The Senior Associate CFO for Financial Management and the Associate CFO for Corporate Budget are responsible for:

1. Approving test plans.

2. Designating a FACT Technical Review Board representative and back-up.

3. Providing subject matter experts (SMEs) to points of contact (POCs) to review the control design analysis to verify that the transaction lead identified key controls.

4. Delivering requested internal control documentation stated in the Prepared by Client (PBC) listing timely.

5. Developing and monitoring corrective action plans (CAPs) for identified weaknesses.

6. Reviewing and signing the Test Results Spreadsheet (TRS), Combined Issues Report (CIR) and Executive Summary, as applicable.

7. Signing the Executive Summary to acknowledge test results.

(1) Assurance Review Testing is responsible for:

1. Providing clear and concise communication of FACT assessment objectives throughout the agency.

2. Approving the FACT assessment methodology and guidance.

3. Leading the coordination of testing activities and timelines with process owners, Treasury and GAO.

4. Ensuring the FACT team carries out assessments in a thorough, effective and timely manner.

5. Communicating the results of testing activities to IRS and agency management.

6. Collaborating with SMEs and (POCs) to assist in the timely development of the control design analysis (CDA) and test plans timely.

7. Communicating and coordinating with external oversight groups.

8. Ensuring FACT documentation meets retention standards.

(1) SOI is responsible for:

1. Determining an appropriate sampling method and size for each control based on frequency.

2. Using statistical sampling methods to generate samples for testing.

(1) FACT teams are comprised of the transaction lead and individuals that assist with the execution of the test plan (also referred to as transaction co-leads).

(2) FACT testing teams are responsible for:

1. Obtaining and reading applicable IRMs, interim guidance memoranda, standard operating procedures (SOPs), job aids, Servicewide Electronic Research Program (SERP) alerts, IRM Procedural Updates (IPUs), GAO/TIGTA audit reports and other guidance related to assigned test steps.

2. Completing and reviewing FACT planning, testing, and reporting activities to ensure that all requirements have been satisfied.

3. Conducting substantive testing of supporting documents received from the process owners.

4. Communicating exceptions found within the test plan to relevant internal and external stakeholders.

5. Verifying that all necessary supporting documentation is available for assigned test steps.

6. Verifying facts with the appropriate process owner (to include the condition, criteria, cause, and effect), when exceptions are identified.

7. Analyzing test results to determine if internal controls are in place and working effectively.

8. Reporting test results to the process owners, management, and other relevant stakeholders.

9. Recommending future test plan updates based on the execution of the test plan and lessons learned.

(1) The FACT section chiefs are responsible for:

1. Providing guidance and support for planning, testing, and reporting activities in order to determine the effectiveness of internal controls over financial reporting, mitigate risk and ensure the quality of IRS data.

2. Coordinating with internal stakeholders and business units to identify areas of risk related to key internal controls.

3. Directing test procedures to evaluate whether internal controls are effective at managing and mitigating risk and ensuring data integrity for financial reporting.

4. Reporting the results of internal control testing and prompting program managers to develop and implement corrective action plans to remediate any control deficiencies and/or weaknesses that were identified during the course of the review.

5. Directing the entry of resulting findings into the JAMES system, monitoring of open items and review of supporting documentation until closure can be accomplished.

6. Engaging with external stakeholders, to include the Department of Treasury and GAO, when developing and implementing program guidance, performing assessment activities, determining outcomes and reporting results.

7. Developing/delivering training and Knowledge Management tools to support operationalization of internal controls activities at the program level.

(1) The FACT team leads are responsible for:

1. Supporting team members throughout the FACT review cycle. Team leads serve as the first level of support for questions.

2. Providing feedback to Transaction Leads and co-Leads throughout the review process. This includes providing guidance, sharing best practices, and identifying opportunities for improvement.

3. Providing JAMES report of open transaction findings to Transaction Lead and co-Leads during planning stage.

4. Staying informed on the status of team milestones, deliverables, and issues.

5. Reviewing and signing-off on transaction steps and work papers in TeamMate.

6. Providing coaching notes to team members.

7. Completing assigned deliverables for Treasury and GAO stakeholders.

8. Providing input on program guidance, staffing, transaction assignments, and relevant timelines and deliverables.

9. Serving as a subject-matter-expert and providing recommendations and guidance to Section Chiefs, Transaction Leads, and Co-leads.

10. Helping team members resolve issues or escalate issues, as needed.

11. Notifying BUs, POCs, SMEs of any changes to the FACT process.

(1) The process owners are responsible for:

1. Providing POCs and SMEs to identify and describe applicable internal controls, review the CDA and verify that FACT test plans accurately capture key internal controls related to the process.

2. Participating in and coordinating FACT interviews and walkthroughs to describe applicable internal controls and to answer any questions.

3. Communicating existing audit findings or recommendations (noted by GAO or TIGTA), the status of corrective action, and how it relates to processes under review, if applicable.

4. Gathering and delivering Internal Control documentation that is included in the PBC listing, or has otherwise been requested, by the respective due date.

5. Evaluating existing management review procedures.

6. Reviewing and signing the TRS, CIR and Executive Summary, as applicable.

7. Developing, executing and monitoring CAPs (for reported issues) to meet projected completion date(s).

8. Providing timely PCA responses to reported issues through use of the JAMES system.

9. Communicating changes to relevant processes and internal controls.

(1) Financial statement assertions are the implicit or explicit assertions that management is making to users of their financial statements. The role of FACT is to test the controls to determine whether management's assertions can be supported. The financial statement assertions are:

1. Completeness

2. Existence and occurrence

3. Accuracy and valuation

4. Rights and obligations

5. Presentation and disclosure

(2) Completeness - Addresses whether all transactions and accounts that should be in the financial statements are included. To support the completeness assertion, FACT obtains sufficient, competent evidence that transactions that should be recorded have been recorded.

(3) Existence and occurrence - Addresses whether assets or liabilities exist at a given date or recorded transactions have occurred during a given period. To support the existence and occurrence assertion FACT obtains sufficient evidence that the asset or liability existed at the time it was recorded.

(4) Accuracy and valuation - Addresses whether assets, liabilities and equity interests included in the financial statements are at appropriate amounts and any corresponding adjustments are appropriately recorded. To support the accuracy and valuation assertion, FACT obtains sufficient evidence that transactions have been recorded accurately.

(5) Rights and obligations - Addresses whether the entity holds or controls the rights to assets included on the financial statements and that liabilities are obligations of the entity. To support the rights and obligations assertion, FACT obtains sufficient evidence to confirm the IRS has a legal title or controls the rights to an asset or has an obligation to repay a liability.

(6) Presentation and disclosure - Addresses whether components of the financial statements are properly classified, described and disclosed. To support the presentation and disclosure assertion, FACT obtains sufficient evidence to support that the account balance has not only been properly measured but also adequately described and disclosed.

(1) The test plan template is created during the planning phase to ensure consistency among all test plans. The template is used as the basis for all FACT test plans. The template contains the following sections:

1. Introduction

2. Scope of the test

3. Control test

4. Test objectives

5. Results of testing

6. Effectiveness of controls

(2) Introduction

1. Test objective (Purpose of the test)

2. Expected results (What is the expected outcome?)

3. Controls tested (Identify IRS controls tested in this test plan, and state whether they include all controls in the CDA)

4. Contact Name (Name of person to contact for explanation of issues/problems)

Note: Test plans that are tested in both interim and fourth quarter testing cycles will have one test plan that captures both periods (the full year).

(3) Scope of the Test

1. Delineate the scope of the test based on the control’s nature, frequency and timing (Are all processes being tested or a specific subset? What is the frequency of the testing?)

2. Identify the resource capabilities required to perform testing (What degree of knowledge is required for performing the test?)

3. Identify other resources needed to perform the control test (Who and what is needed to perform the testing?)

4. Determine of the type of relevant reporting assertion(s) provided by the control(s) (What type of assertion(s) are provided? Rights or Obligations; Completeness or Accuracy; Presentation or Disclosure; Existence or Occurrence; and Valuation or Allocation) Determination of the type of relevant reporting assertion provided by the control (What type of assertion do the controls provide?) Rights or Obligations; Completeness or Accuracy; Presentation or Disclosure; Existence or Occurrence; and Valuation or Allocation

5. Identify the method(s) of testing (Inspection of Documents, Observation, Inquiry or Walkthrough, or Reperformance)

6. Determine the sample size and basis (Specify the method used to select the sample and sample size.)

7. Assess QAR to determine if the transaction meets the criteria to be deemed a QAR as discussed in IRM 1.4.31,IRS Quality Assurance Review Program.

(4) Control Test

1. Identifies the information needed to conduct the test (List documents required for testing)

2. Describes the documentation requirements (Describe the documentation process of the test content and results) Steps for testing transaction controls (What are the steps to perform the test against the sample?)

(5) Test Objective

1. In general, internal control test objectives describe an assessment of one or more aspects of an entity’s internal control system and are designed to provide reasonable assurance of achieving effective and efficient operations, reliability of reporting for internal and external use, or compliance with provisions of applicable laws and regulations.
   i.) Test objectives may vary widely (based on the process under review) and are used to verify that internal controls are effective and operating as intended.

2. Each objective (in the test plan) includes a list of steps that describe the methodology that will be used to accomplish the test objective.

3. Each test plan includes an objective that addresses the design of the internal control system (under review). The purpose of this objective is to determine if the internal controls in place are designed adequately and to communicate any associated vulnerabilities. Steps (methodology) taken to achieve this objective include:
   i.) Reviewing relevant internal control documents (such as operating procedures, manuals, policies, and desk guides);
   ii) Conducting interviews and/or walkthroughs;
   iii) Assessing risk; and
   iv) Reviewing the results of other oversight activity. Relevant sources of information include GAO and TIGTA audit reports GAO Management Report (related to the IRS financial statement audit) GAO audit findings, also called Matters for Further Consideration (MFCs) Internal (IRS) reviews.

4. In addition, each test plan also includes an objective that verifies the status of prior FACT findings and recommendations to ensure that corrective action (when appropriate) was taken to remediate the issue observed.

(6) Results of Testing

1. Determine whether the controls that were tested are effective, overall.

2. Determine whether the process owner(s) consistently applied the controls.

(7) Effectiveness of Controls

1. Determine the effectiveness of the controls.

2. Determine if reportable issues are required.
   i.) If the process owner disagrees with an issue, obtain written documentation from the process owner that describes the reason for the disagreement.
   ii.) In addition, if the process owner chooses to accept the risk identified, in lieu of implementing corrective actions to remediate the finding (control deficiency, significant deficiency, material weakness), obtain written documentation that describes the rationale for doing so.

3. Determine if corrective action plans are required.

(1) In defining the population, the transaction lead should identify the entire set of items from which the sample should be drawn. This includes:

1. Verifying the entire population is accounted for when the sample is drawn.

2. Determining the source document or the transaction documents to be tested.

3. Defining the period covered by the test.

4. If applicable, identifying significant subsets within the population, such as high dollar value items, and working with SOI to develop an appropriate sampling plan.

(2) The sample items selected for testing purposes must come from the current fiscal year. However, when transactions occur only at the end of the fiscal year, a sample selection from the previous fiscal year may be permissible.

(3) Changes to internal controls over financial reporting process and changes to financial systems should be considered when developing a sampling plan.

(4) When sampling from multiple locations, the population may include all or several locations if the controls at each location perform the same function and use the same internal controls. Before combining separate locations into one population, management and the transaction lead should consider such factors as:

1. The extent of uniformity of the controls and their applications at each location.

2. Whether the individual locations can make significant changes to the controls or their application of these controls.

3. The amount and nature of centralized oversight or control over local operations.

4. Whether there may be a need to develop separate conclusions for each location. If the testers, transaction lead or manager concluded the locations should be separate populations, then transaction leads must select separate samples at each location, and testers and management will evaluate the results of each sample separately.

(5) The transaction lead sends the population to SOI to generate the sample. SOI works with the transaction lead to determines the most appropriate sample method for each test to be performed. Sampling methodologies must be:

1. Reliable: Will the sampling approach produce dependable results?

2. Consistent: Can the sampling approach be applied uniformly?

3. Valid: Does the sampling approach adhere to applicable guidance and best practices? Does the test plan measure what it is intended to measure?

(6) FACT generally applies one of the following two sampling methods.

1. Non-statistical sample: A subset of a defined population, selected using judgement, but not valid to make statistical inferences within a defined level of confidence and precision.

2. Random sample: A subset of a defined population, selected using a statistically valid methodology in which every member of the population has a known, non-zero probability of being selected. With this method, transaction leads can make inferences about the population with a defined level of confidence and precision. The confidence level is fixed, but the precision level can vary. Usually, estimates have more precision as sample size increases.

(7) Additional sampling consideration include:

1. Seasonal fluctuations (such as periods of limited availability), due to the nature of an activity, may necessitate multiple samples that cover several periods throughout the year to ensure a representative sample. The transaction lead should fully disclose seasonal fluctuations and other noteworthy conditions to SOI so that they can make an informed recommendation for an appropriate sample methodology.

2. In some instances, transaction leads may find that one or more of the sample items selected for testing cannot be reviewed (for example, the transaction was reversed and is no longer there). In these circumstances, the transaction lead should work with SOI to identify a replacement sample for testing and clearly document the need for this approach. As a precaution, transaction leads may ask SOI to identify additional sample items which can be used to test a control when a sample item cannot be tested. In this scenario, the transaction lead would test the next sample item identified in the sample selection list.

(1) Quality reviews and quality assurance processes that are already in place are considered Structured Management Reviews (SMRs) and may be tested as part of a FACT review. In addition, SMRs can also be leveraged to provide reasonable assurance over internal controls that are covered under a FACT review. If a transaction lead plans to leverage a SMR the review must contain sufficient information to enable an individual with no previous connection with the evaluation to understand what was reviewed, what was found, and to verify the reviewer’s judgments and conclusions. Refer to IRM 1.4.31, Resource Guide for Managers, IRS Quality Assurance Review Program, for additional details related to Quality Assurance Reviews.

(2) To be considered, a SMR should have the following elements:

1. Documented procedures that guide the SMR.

2. Reviews performed at regular intervals.

3. Documented and independent review of results.

4. Documented processes to resolve noted deficiencies.

(1) Substantive testing is performed by following the procedures the transaction lead identified in the test plan to ensure controls are implemented and working as intended. The transaction lead may delegate substantive testing to supporting team members. The team member testing the samples must appropriately document and record test steps in their workpapers.

(2) All aspects of testing activities require a high level of documentation. Documentation provides support for FACT planning, testing, and reporting processes, aids those conducting and leading the testing, and allows for reviews to be conducted. The test team obtains sufficient and appropriate evidence to develop a reasonable basis for an opinion regarding the effectiveness of internal controls tested through inspection, reperformance, observation, inquiries or confirmations. The documentation of evidence supports overall FACT conclusions.

(3) Documentation related to planning, testing and reporting on FACT activities should contain sufficient information to enable an individual who has had no previous connection with the testing to understand what was tested, how the test was conducted, the test results and to verify the reviewer’s judgments and conclusions.

(4) The FACT team determines the quantity, type and content of documentation, which provides a clear understanding of the internal control test’s purpose, data sources, results and conclusions. The team organizes the documentation logically to provide a clear link to the conclusions and issues. FACT test documentation must contain the following items:

1. Objectives, scope and methodology for each transaction, including the testing period, a description of the sampling methodology, and if the team deviated from the approved sampling methodology, the rationale for such actions.

2. Support for each test conducted, including the copies of documents examined and the rationale for key decisions and any deviations made from approved guidance.

3. Testing results, analysis and conclusions that provide a clear and concise summary of results cross-referenced to supporting documents and resolution of exceptions or other issues.

4. Evidence of transaction lead and/or supporting team member review and sign-off of workpapers and steps (as prepared) prior to supervisory review.

5. Evidence of FACT section chief, team lead or senior team member review of the work performed that supports conclusions about the controls tested.

(5) Workpapers document the FACT review and record information obtained and analyzed during the FACT process. CCH TeamMate maintains all workpapers created directly in the system as well as workpapers scanned and uploaded into the system. The FACT team prepares and updates workpapers throughout the planning and testing phase and documents the following in CCH TeamMate:

1. Plans for the review, including the test plans.

2. Examination and the evaluation of the adequacy and effectiveness of the systems of internal control.

3. Test procedures followed, the information obtained and the conclusions reached.

4. Management reviews.

5. Audit reports.

6. Issues.

(6) The transaction lead is responsible for determining which documents to include in the workpapers; the workpapers must include the following:

1. A lead sheet identifying all items, attributes and findings (i.e., x = exception, check mark = no exception).

2. For one sample, the workpapers must include one complete example that clearly identifies and documents all attributes tested.

3. For samples that contain exceptions, the workpapers must include all supporting documents.

4. Documents that may not be retrievable in their exact form at a later date. For example, if a screen print is necessary to support a number or dollar amount that may change in the future, that screen print should be retained to verify that figure as of the test date.

(7) Among the required items above, workpapers may also include:

1. Planning documents and review plans.

2. Control questionnaires, flowcharts, checklists and the results of control evaluations.

3. Documentation of walkthroughs and interviews.

4. Organization charts, policy and procedures statements and job descriptions.

5. Copies of important contracts and agreements.

6. Letters of confirmation and representation.

7. Photographs, diagrams and other graphic displays.

8. Results of analytical review procedures.

9. Audit reports and management replies.

10. Emails, memos and other relevant correspondence.

11. CAPs, if appropriate and available.

(8) The documentation within the workpapers must be appropriately organized to provide a clear link to the overall conclusion. Workpapers must be sufficient to show that the transaction lead completed the following:

1. Obtained guidance to understand the internal control, plan the testing and determine the nature, timing and extent of the tests performed.

2. Adequately planned and supervised work.

3. Observed standards of test work.

4. Obtained sufficient and appropriate documentation to support a reasonable conclusion.

(9) The transaction lead should use the following techniques for documenting in workpapers:

1. Notation: Highlight or identify the specific attribute in the workpapers that the team member verified, such as a signature indicating managerial approval.

2. Indexing: Workpapers will be automatically indexed once loaded into TeamMate to verify test plan results are properly referenced and can be easily traced to supporting documentation. When referring to reports in TeamMate, use the reference number and page number. Based on the associated test objective to the workpapers, TeamMate will automatically assign each workpaper a reference number.

3. Sources of data: Clearly identify the source of any information appearing in workpapers. An independent reviewer should be able to retrace the reviewer’s steps, from basic schedules to summaries and comments. Worksheets should be cross-referenced to other related workpapers and to the test plans. Effective cross-referencing often reduces the need to duplicate data.

4. Workpaper summaries: The process of summarizing provides an objective overview and puts findings in perspective. The team’s summary should focus on key information and data. Do not include trivial information or editorial comments not supported by testing. Periodically summarizing findings helps verify firm control over the test.

5. Record Key Meetings and Interviews: Record all key discussions (meetings and interviews) used as support for key decisions (testing decisions/conclusions) and understanding the subject matter or test evidence and include the notes in the workpapers. Key decisions and conclusions are often a result of meetings and interviews. Without a record, important information will be lost. Use the format below.

6. Keep the Writing Simple: Workpapers should be clear and concise to an uninitiated reviewer. Avoid jargon and explain all technical terms and acronyms in a separate part of the workpapers (glossary of terms).

7. Keep Workpapers Understandable: Workpapers should be clear, concise and must stand on their own. They should not need any supplementary information. Anyone reading the papers should be able to determine what the team member set out to do, what they did, what they found, and what they concluded.

8. Safeguard PII: Some workpapers and documentation contain PII (taxpayer, employee, vendor data, etc.) based on the type of review being performed. All PII must be protected according to the guidelines in 1.4.18.12.4, Personally Identifiable Information (PII).

9. Keep Workpapers Relevant: Workpapers should be restricted to relevant and material matters; they should directly relate to the review’s objectives. Well-organized test plans, execution of FACT procedures and workpaper reviews help verify the inclusion of relevant documents only. Do not include editorial comments and observations not supported by testing. It is important that all conclusions are in context and related to specific evidence.

(1) Test results support the FACT team’s conclusion on whether the controls (being tested) are adequate and effective. Exceptions found when testing may indicate that there is an issue with the controls. A testing exception is an attribute that does not meet the expected test criteria.

1. When exceptions are noted, the transaction lead should, in consultation with the team lead and section chief, determine the impact of the exception and the likelihood that the entity’s controls will fail to prevent, or detect and correct, misstatements in financial information.

2. When making this determination, the FACT team should consider a number of factors, to include: the frequency of errors, compliance with laws and regulations, materiality, impact to financial reporting, and if compensating controls are in place to reduce or address the impact and likelihood of the exception(s) noted, among other things.
   i) In this context, a compensating control is a technique or other effort(s) designed to mitigate a control design deficiency, or ineffective operation or implementation of a control, or the simple lack of control over a financial process or program.

3. Test exceptions may result in audit findings which could involve deficiencies in internal control; noncompliance with provisions of laws, regulations, contracts, and operating procedures (among other things); or instances of fraud.
   i) If fraud is suspected, the FACT team will pause testing, promptly notify TIGTA, and wait for instructions on how to move forward.

(2) If testing exception(s) result in an audit finding additional consideration is needed to classify the finding according to the parameters below (listed from least severe to most severe):

1. Control Deficiency: Exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.
   i) A simple deficiency is an internal control deficiency that creates minimal exposure for management and is generally an anomaly. Examples could include missing initials indicating a supervisor’s review on 1 of 26 reconciliations sampled, or the slight delay of an internal control activity.

2. Significant Deficiency: A significant control deficiency, or combination of internal control deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process or report external financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the entity’s financial statements, or other significant financial reports, that is more than inconsequential will not be prevented or detected.
   i) The term “remote” is defined as the chance of the future event, or events, occurring is slight.
   ii) A misstatement is “inconsequential” if a reasonable person would conclude, after considering the possibility of further undetected misstatements, that the misstatement, either individually or when combined with other misstatements, would clearly be immaterial to the financial statements. If a reasonable person could not reach such a conclusion regarding a particular misstatement, that misstatement would be more than inconsequential.
   iii) Significant deficiencies are reportable conditions that warrant the attention of the Management Controls Executive Steering Committee.

3. Material Weakness: A reportable condition, or combination of reportable conditions, that results in more than a remote likelihood that a material misstatement of the financial statements, or other significant financial reports, will not be prevented or detected. Material weaknesses are reportable conditions that warrant the attention of the Management Controls Executive Steering Committee.

(3) In addition to the categories described above, the FACT team may encounter a situation that doesn’t rise to the level of an audit finding, yet still warrants the attention of internal control process owners. Under these conditions, the FACT team has the ability to issue a Management Information Only (MIO), which serves to notify the process owner of the situation observed. Unlike the findings described above, MIO notifications do not require a response or corrective action plan.

(4) All audit findings and MIOs require formal documentation and notification to the process owner and IRS management. When documenting the issues and situations observed FACT team members must include the following information:

1. Classification: The type of issue observed (Control Deficiency, Significant Deficiency, Material Weakness or MIO).

2. Condition: A description of the situation in which the exception or issue was observed, along with any other pertinent information.

3. Criteria: Criteria may include the laws, regulations, contracts, standard operating procedures, IRMs, standards, measures, expected performance, defined business practices and benchmarks against which performance is compared or evaluated.
   i) Criteria identify the required or desired state or expectation with respect to the program or operation.
   ii) Criteria provide a context for evaluating evidence and a basis for understanding the findings, conclusions and recommendations that are being reported.

4. Cause: The cause is the factor or factors responsible for the difference between the condition and the criteria. The cause may also serve as a basis for recommendations for corrective actions.
   i) Common factors include poorly designed policies, procedures, or criteria; inconsistent, incomplete or incorrect implementation; unintentional oversights, or factors beyond the control of program management. Auditors may assess whether the evidence provides a reasonable and convincing argument for why the stated cause is the key factor contributing to the difference between the condition and the criteria.
   ii) The FACT team should follow-up with the process owner to make sure that they have a clear understanding of the root cause.

5. Effect or potential effect: The effect or potential effect is the outcome or consequence resulting from the difference between the condition and the criteria. It describes the impact or potential impact associated with the deficiency observed.
   i) Effect or potential effect may be used to demonstrate the need for corrective action in response to identified problems or relevant risks and should consider materiality, impact to financial reporting and compensating controls, among other things.

6. Recommendation: A recommendation is the FACT team’s proposed solution to address the deficiency observed and root cause.

7. Responsible Entity: The finding should indicate the responsible entity and process owners and/or manager(s).

8. Owner Response with Corrective Action Plan: After the information listed above has been prepared the FACT team issues the finding to the process owner and asks for their response. An owner response should describe management’s position on the issue and include a description of the corrective action that is planned to address the issue(s) observed. Corrective action should seek to address the root cause of the issue, correct past deficiencies (if possible) and prevent reoccurrence.
   i) If, for some reason, the process owner disagrees with the FACT team’s finding and recommendation, they should include a description for the basis of their disagreements and planned action when moving forward.
   ii) This also applies to situations where the process owner chooses to accept the risk associated with the deficiency. If the process owner chooses to accept the risk the FACT team will follow-up to request documentation in the form of an executed Risk Acceptance Form and Tool.

9. Estimated Completion Date for Corrective Action: The Owner’s Response should include an estimated completion date for the corrective action plan.