Maintenance record

Sampling:

the dialog that extends a sample fitting the screen, its title and its action within reach.

AI testing under the auditor's disposition:

• a rule test standing for the sample only where every sampled item is among the rows its condition selects, the rows left out stated in the panel and the binder;
• and the AI statement stating the testing method, saying the prompt and rules in force are later than the latest run with the model, and offering a licensee's quality or risk team that run's records.

Exceptions and deficiency evaluation:

• the exceptions summary counting severity among the open exceptions only;
• and the Testing step's bulk actions bar reporting exceptions created from failures only when there are some.

Conclusions and sign-off gates:

sign-off refused before the lock where the save it makes would set a quality review answer aside, naming the finding and the action that records it.

Binder and archive:

export file names dropping a comma from the client name in every form.

Platform:

a reference engagement file card on the dashboard of demonstration organizations, shown when the file is offered.

Population and its provenance:

the upload screen proposing as the identifier a declared key whose values are all different, proposing declared fields from the control's aliases when no header names the field, and naming a repeating identifier column before the upload and in the audit trail.

AI testing under the auditor's disposition:

• each AI test result recording in which mapped files it located the sampled item and on what basis, with the binder's Evidence Index and the quality review counting a file as located only on the item's own key or a record only its own population row points to;
• an AI test locating a sampled item by the identifier its population row records where its natural key stands only in a loose form, counted only as a record's own identifier, and by its own record in a PDF, never by a record headed by another identifier;
• and the auditor confirming the structure of a CSV or Excel evidence file (its header row, the column holding each part of the item's key and the columns naming who acted), with AI testing reading a confirmed file by that structure alone and holding for the auditor a table it cannot read without guessing.

Quality review:

• quality review findings stating the records they list in one order, so a review run again on unchanged records states each finding in the same words;
• configuration checks reading each setting against its own expected value, with Policy Non-Compliance comparing configured and expected values setting by setting and a listing's breakdown by system read from its system column;
• quality review findings naming each assigned system by the name the scoping step shows, and Policy Non-Compliance saying whether a row's compliance cell is blank or holds other text;
• configuration conditions such as a minimum password length evaluated against the configured value where both state numbers in one unit, and point-in-time listings checked by their as-of date against the end of the tested period;
• quality review checks measuring a completion against the row's own due date and closing date, reading an exception as approved only where the row states an approval in force at the as-of date, and reading an analyzer report whose label states none as clean;
• and quality review checks reading an approval, a waiver, a closure or an SOD removal only where the whole value fits its grammar, its approver a listed role, a full name or dotted initials, every date read and the next review after the as-of date, and saying any other value is not in a form the checks read.

Binder and archive:

• the Export Readiness panel opening the export page within the application, and the demonstration data pack downloading from the dashboard under its own file name;
• evidence index references in the binder for the files mapped to the item and attribute of each exception raised against a sampled item, and for each data procedure input file the evidence index lists;
• the binder and the Audit Trail recording a reconciliation added to a population after its upload as that, apart from a corrected population record;
• binder wording held to the record: a selection note on the audit trail, every sample number in the evidence index and a glossary of the abbreviations the file uses;
• an AI test result the platform held reading, once decided, as the decision the auditor recorded, with an override to the model's own proposal named as the auditor recording it and counted apart from overrides;
• the cover's management representation letter row taking a reference in place of a date, and the exceptions section stating, for each exception that names no sampled item, what its record shows, and what each deviation pattern spans;
• a binder printing a long list of facts a result kept once, with a later result that has the same long list naming the result that prints it;
• the binder's traceability section printing a release control's five recorded chain steps with their references, and the release, version and rollback plan from the population row beside them, and a chain status of Complete only for steps passed with a reference and a date;
• the publication copy of an illustrative engagement whose scope is not yet final exporting with its roll-up conclusion, and the publication name check reading large documents in time proportional to their length;
• and a binder larger than one file can carry exported in parts, each carrying every engagement-level section and its own controls, recorded under one set identifier, carried in the archive package where its parts render within one package request and otherwise downloaded one by one from the Export page.

Tenant isolation, audit trail and identity:

• a control assigned only systems recorded on its own engagement, any other system refused before anything is written;
• and a control or an exception assigned only to an active user of its own firm, held by the request and by the database's own key, any other user refused before anything is written.

Binder and archive:

• binders exported again reading differently in their sampling, rule test, audit trail and evidence index sections, each entry about an AI test result's earlier version labelled for what it records, and a two-stage sample with a review missing, when evaluated again, asking anew for the acknowledgement of its quality review findings on the sampling basis and the conclusion;
• an AI test result keeping the facts matched to its sample item and those given to the model, with a binder line for each file whose other rows are not kept, giving its counts and the SHA-256 of its full fact set;
• and the binder's audit trail and the Audit Trail page's download naming the AI test result each entry is about by its control, attribute and sample item.

Platform:

public pages and a manual that draw the sign-off chain, the path from evidence to the archive package, the re-performance of a sample, who reaches an engagement's file, the data paths by role, the deviation policy and an exception's lifecycle as figures.

Sampling:

• items the auditor chooses added to a random sample with a stated reason, recorded outside the random draw and never projected, and the basis for a sample's risk level restated after the draw with the text it replaced kept on record;
• and a sample draw whose answer does not reach the screen followed until its stored sample is read, the draw buttons disabled meanwhile, and the quality review's data-integrity table opened with every check on one page.

Evidence and extraction:

• evidence files linked to an exception found outside the sample and listed beside it in the binder, the uploaded files nothing in the file uses listed for the auditor's judgement before sign-off, and an auditor's reading note printed in its own section of the binder;
• and evidence files linked to a control's deficiency evaluation and to a population's completeness reconciliation, named with the control in the binder's evidence index.

AI testing under the auditor's disposition:

a population screen applying named checks to every row of the population alongside the sample, each hit decided by the auditor as a known deviation that is never projected, and conflicts with the sample named before sign-off.

Binder and archive:

the binder's audit trail keeping, whatever their date, the entries that record the file's scope, its sample draws and restated records, exceptions, evaluations, control conclusions and sign-offs, marking the entries of a sample since superseded, and printing each test criterion confirmed as written with its reason.

Tenant isolation, audit trail and identity:

an invitation to an organization accepted on the platform's own sign-up page, which creates no account without one.

Platform:

the demonstration data pack downloaded in the app after sign-in and acceptance of the current terms, each download recorded on the firm record.

Scope and systems:

an operations control not signed off while its recorded scoping lists no system in scope.

Evidence and extraction:

evidence mapped to one attribute or as supporting evidence for a recorded result, and an evidence expectation recorded as not applicable to the drawn items with the auditor's reason, printed in the binder in place of not obtained.

AI testing under the auditor's disposition:

• a value from the population listing checked against every record of the item the model was shown, and a quotation verified where it renders one record faithfully and held where a word is changed;
• an attribute an AI run could not test marked as needing a re-run with the reason and its earlier verdict kept in the result's history, and one AI run of a sample at a time, Cancel stopping the run within seconds;
• a PASS that rests on a severity or priority written only in the population listing held at INCONCLUSIVE for the auditor to conclude on, these checks reading the words written and leaving their meaning to the auditor, so a correct answer may be held for the auditor's reading;
• dates and severity levels read in more of the ways a rationale or the population listing writes them, and a PASS that applies a window where none can be read for the item's level held at INCONCLUSIVE;
• every AI PASS and NOT APPLICABLE waiting for the auditor, a held answer shown with the reason it was held and the model's quotation and confirmed or decided differently on its own card with a note, AI results never accepted in bulk, and a FAIL the model gives never turned into a PASS;
• an AI request whose answer does not reach the screen, after a gateway error or a dropped connection, followed on screen until its stored result appears, its button disabled meanwhile so that no second run is started;
• a PDF form's label and value, every column of a PDF or Word table, each record of a PDF of many records on its own, and a JSON document's values by their key path, checked where the file's text states them;
• and the evidence behind an AI answer read more strictly before "Checks matched — your decision": a fact counted only on the sample's own record, a field that may deny the act or a same-day time of day holding the answer, an unreadable answer never recorded as cleaner, and what a file does not plainly show disclosed.

Exceptions and deficiency evaluation:

• an evaluated deficiency on a control with no system counted in the deficiencies-in-combination gate, finalizing and export readiness waiting for a combination record over each group, and finalizing asking for confirmation before it proceeds;
• and an exception's attribute changed after it is raised with a recorded reason and an audit-trail entry, the exceptions review and the deficiency evaluation's basis following the change, and a workbook read alike by the Population step and the data procedures, from its first visible sheet with merged cells filled.

Conclusions and sign-off gates:

• sign-off held until every failed test result, the auditor's own or a reviewed AI result, has an exception, so the exception register lists every failed test result, and one calendar-day rule for a traceability step dated without a time across the chain, the lock, the conclusion and the binder;
• a standing sequence deviation on a change's traceability chain treated as a failed result needing its own exception, the sign-off gate, the conclusion and the Exceptions step reading every failed attribute and deviation alike;
• a control not signed off while an evidence file it cites failed its latest hash re-verification, until the file is replaced or unmapped;
• and a restore-test or log-review control at a calendar frequency not signed off until its occurrences are reconciled to the control's periods.

Quality review:

• a recorded exception, dormancy justification or follow-up action read by quality review as documented only where the value affirms itself, a mixed or unread value raised for the auditor to answer before sign-off, and a quality-review result unchanged on a new run keeping its acknowledgement;
• a failed or warning quality-review result cleared by an evidence document the auditor names, the result keeping its status and the binder naming the document with its SHA-256;
• and a backup control's checksum verification and malware scan measured by quality review within each row's own quarter, and its recovery drill within the twelve months to that row's period end.

Binder and archive:

a publication copy of an illustrative engagement released only when its binder, evidence index and archive package name no third-party product, the scan reading the text inside plain-text, PDF, office-document and image entries.

Platform:

• evidence uploads sent to storage as a plain file without depending on the network's support for HTTP/2, a cancelled upload stopping its transfer, and the Exceptions step and sign-off agreeing on the items a control did not apply to;
• a criterion tailored after AI verdicts are recorded against it recorded with its reason, each verdict kept in the result's history under the criterion it was tested against, and a re-run of its sample asked for before sign-off;
• the auditor's own result on a sample and attribute counted by the Testing step as by every gate, and Run AI on All leaving out the attributes a rule test covers over the whole population and, unless a full re-test is asked for, those the auditor recorded by hand;
• an attribute a rule test covers over the whole population left out of AI testing, each item's result on it the rule's own outcome for its row and labelled as the rule's, and a deficiency evaluation recording the rule-test rows it rests on;
• and on the demonstration deployment, the terms each account holder accepted re-readable from the account page with the version and time accepted, and the platform operator's page listing who accepted which version.

Scope and systems:

each in-scope application listed by name, several of one class among them.

Population and its provenance:

• a population's extract recorded with its date column and window, and period coverage computed from that column where there is one;
• and occurrence reconciliation for controls run daily, every business day, every two weeks, twice a year or once a year.

Sampling:

• a two-stage sample whose reviews are named by a combination of columns, such as a campaign and its system, with the first stage sized for each system, and a drawn sample's rationale revised under a stated reason without a new draw;
• and a sample stratified on any column of the population's file.

Evidence and extraction:

• one evidence file tagged to every evidence expectation it answers;
• and evidence independence read from what a file records, a file repeating the population's rows by value, counted from the file's side or the population's, read as an extract whatever its headings and its own further columns still usable, a file sharing the population's key but otherwise recording facts of its own read as independent evidence, and a system export repeating the listing's data accepted as the source of its completeness where records of other items, counted as distinct keyed records carrying data, make up at least a tenth of the records counted.

AI testing under the auditor's disposition:

• the counts and lists that AI drafts restate, in all drafts but the override justification, checked against the record where a count in digits or in words up to twenty is tied to what it counts or a draft must name every recorded item, a draft that does not match written once more and otherwise withheld with the reason, and a sampling memo that ends on the auditor's own judgement;
• each data-procedure run named by when it ran, and an AI result's review history kept by the database until a recorded removal of its control, engagement or workspace;
• the records of the people and entities a sample names shown to AI testing, each labelled as theirs and never as the sample's;
• a sampled row's value relied on in AI testing only where the population's completeness and accuracy reperformance matched it to the client's own system records;
• and an AI result's links to its sample, its control and its engagement held by the database once the result exists.

Exceptions and deficiency evaluation:

• the basis of a deficiency's severity named by the engagement's type;
• the auditor's deletion of an exception or of an evidence file taken only with a stated reason, and every exception removed recorded whole in the audit trail the binder prints;
• and a control removed from scope only with a stated reason, its earlier entries kept in the audit trail and marked as removed with it.

Conclusions and sign-off gates:

• a change's traceability chain checked against the order its own control requires, and client dates and times read in the engagement's own time zone;
• the latest data-procedure run taken in the order of the hash-chained audit trail;
• and an AI result the reviewer rejected without a result of their own never taken as the sample's result, the sample shown as awaiting review, named among what stops sign-off and counted as neither passed nor failed.

Binder and archive:

the archive package's audit trail, manifest and sampling record, and the audit-trail download, naming people, records and data-procedure runs in words.

Tenant isolation, audit trail and identity:

• a file accepted for upload only to an engagement the auditor may open;
• people and controls named in words on screen and in the binder, never by an internal identifier;
• each evidence download recorded in the audit trail before it is served, and refused with a message to try again when it cannot be;
• and a change and its audit record refused together, with a message to try again, when the audit trail cannot record them within seconds.

Scope and systems:

• any template criterion tailored to the client's own policy, with the reason on the audit trail;
• the entity's own control reference, description and owner recorded on each control;
• and the reason for each of the 37 control templates' COSO 2013 mapping, recorded with the template.

Population and its provenance:

• data procedures run on the engagement's own files, a listing reperformed against an independent source among them;
• rule tests over every row of a population, and each instance's expected occurrences set against those listed;
• and segregation-of-duties rules and settings listings re-performed against the client's own records.

Sampling:

• the privileged access review tested review by review, with its coverage of the system's privileged accounts and the spacing of the reviews across the period, and each review's results recorded once;
• and a stratified draw that tests chosen strata in full and samples the rest.

Evidence and extraction:

uploaded workbooks read under a size and structure guard.

Conclusions and sign-off gates:

• the engagement partner's and quality reviewer's signatures taken only once every control is signed off, and an Effective conclusion over deviations only with a recorded judgement;
• and a population's completeness established by a sourced control total or a reconciliation before sign-off.

Binder and archive:

deficiency citations in the binder that follow the engagement type.

Tenant isolation, audit trail and identity:

• outside a demonstration workspace, access to each client's file following its engagement team;
• and a client workspace that holds a finalized file kept from deletion.

Platform:

• a binder that opens on the overall conclusion;
• concurrent edits to a control's conclusion, evidence expectations, scoping and system assignment checked section by section, so a save that meets a newer version is refused with the draft kept;
• evidence files checked against storage, and files a deletion left in storage removed on the administrator's request;
• a software bill of materials shipped with the release, and no retrieval index of client content;
• each control bound to the version of the control library it was tested against;
• and the record of an audit-trail verification checked by the database before it stands.