1 For each of the items on the Control Review page, indicate whether or not the control is expected for this vendor, enter any relevant comments and indicate whether or not the control was sufficiently tested. If the control was sufficiently tested, leave the Residual Risk ratings blank. If the control was NOT tested sufficiently, select risk ratings using the dropdown boxes. 2 Items 56 to 61 may be customized by the reviewer to add additional controls. If the Expected column for items 56 to 61 is set to No, these rows will not be printed when the Print button is clicked. 3 The Summary section at the bottom of the checklist will provide totals for the Expected, Sufficient and Insufficient controls. 4 The information from this tab flows into question 10 in the SSAE-16 Checklist Tab. 5 Any high or critical risk deficiencies in this tab should be entered into the Risk Determination Table as a separate entry.
Login to your subscription to download the complete workbook template with all the worksheets.
All materials contained on this site are protected by United States copyright law and may not be reproduced, distributed, transmitted, displayed, published, broadcast, performed nor used to prepare derivative works, without the prior written permission of AuditNet®. You may not alter or remove any trademark, copyright, logo or other notice from copies of the content. For further information, see section 1 of the Terms and Conditions and section 2 of the Subscriber Access Agreement.