# Control Deficiency Evaluation: [Entity name], [Period or deficiency ID]

> Working paper for judging how severe an internal control deficiency is,
> alone and together with other deficiencies, and for recording who was
> told and how it will be fixed. It classifies each deficiency as a
> control deficiency, a significant deficiency or a material weakness
> using the definitions in SEC Regulation S-X Rule 1-02 (17 CFR 210.1-02,
> paragraph (a)(4)) and the evaluation approach in SEC interpretive
> Release No. 33-8810 (2007), Section II.B.1. It also serves companies
> that use the same severity scale for the UK Corporate Governance Code
> 2024 Provision 29 declaration, and public bodies applying GAO
> Standards for Internal Control in the Federal Government (Green Book,
> 2025 revision, Principle 17). PCAOB AS 2201 (auditor's side) and the
> COSO Internal Control framework are cited by name only. Replace every
> `[bracketed]` value and every row marked *Example*. This is a document
> format, not legal, audit or accounting advice. Obtain the standard or
> law for the normative text.

<!--
Guidance: How to use this template
- Purpose: one evaluation per deficiency (or one per period with a
  section per deficiency), plus a single aggregation section that looks
  across all open deficiencies before the assessment date.
- Fill section 3 (materiality and inputs) first. Severity cannot be
  judged without the materiality figure and the list of every open
  deficiency, including those found by internal audit, the external
  auditor and management's own testing.
- Write the deficiency description (section 4) as a fact pattern: what
  should happen, what happened, how many times, since when. Do not mix
  in the conclusion.
- The worked example is fictional: Corvid Commerce Group plc, a SaaS
  retailer listed in London with American depositary shares (ADSs)
  listed in New York, reporting under IFRS as issued by the IASB in EUR,
  with subsidiaries in Germany, the UK, the US and Vietnam. Corvid is an
  SEC foreign private issuer filing Form 20-F, so the SEC definitions
  are binding for its ICFR report under Form 20-F Item 15, and the same
  scale is reused for the UK Code Provision 29 declaration. Its auditor
  is the fictional Ashgrove & Partners LLP.
- Common pitfall: rating each deficiency in isolation and never
  aggregating, so three "minor" gaps over the same revenue account hide
  a significant deficiency.
-->

## Document control

<!-- Guidance: The evaluation is evidence for management's conclusion on internal control. Keep it under document control, record who prepared and who reviewed it, and keep it with the assessment file for the retention period your regime requires. -->

| Field | Value |
|---|---|
| Document ID | [CDE-YYYY] (*Example:* CDE-2026, one evaluation for FY2026 covering DEF-2026-001 to DEF-2026-003) |
| Entity | [Legal name] (*Example:* Corvid Commerce Group plc, consolidated) |
| Assessment date (as at) | [YYYY-MM-DD] (*Example:* 2026-12-31) |
| Financial year | [FY2026, 2026-01-01 to 2026-12-31] |
| Reporting framework | [IFRS as issued by the IASB / UK-adopted international accounting standards / US GAAP] (*Example:* IFRS as issued by the IASB, which are also UK-adopted IAS) |
| Internal control framework used | [Name, e.g. COSO Internal Control, Integrated Framework (2013) / GAO Green Book 2025] |
| Regime driving the evaluation | [SEC Item 308 or Form 20-F Item 15 / UK Code Provision 29 / Green Book / internal policy] (*Example:* Form 20-F Item 15 and UK Code Provision 29) |
| Version | [1.0] |
| Status | [Draft / Under review / Final] |
| Owner | [@head-of-internal-control] |
| Approvers/reviewers | [@group-financial-controller], [@cfo], [@head-of-internal-audit] |
| Last updated | YYYY-MM-DD |
| Classification | Confidential; shared with the audit committee and external auditor |
| Related documents | [Risk and control matrix], [Control testing workpapers], [Management assessment], [Remediation tracker] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Preparer, internal control team | [@name] | Prepared | YYYY-MM-DD |
| Reviewer, group financial controller | [@name] | [Agree / Return] | YYYY-MM-DD |
| Chief financial officer | [@name] | [Agree / Return] | YYYY-MM-DD |
| Audit committee (noted) | [Meeting reference] | Noted | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft after Q3 testing |
| 0.2 | YYYY-MM-DD | [@name] | Aggregation added, external auditor comments |
| 1.0 | YYYY-MM-DD | [@name] | Final as at the assessment date |
| 1.1 | 2026-10-25 | [@name] | Updated to Corvid's SEC foreign private issuer status (Form 20-F), RCM control IDs, retest timing and the FY2026 deficiency register shared with the ICFR templates |

## Contents

1. [Purpose, scope and basis](#1-purpose-scope-and-basis)
2. [Severity scale and definitions](#2-severity-scale-and-definitions)
3. [Materiality and evaluation inputs](#3-materiality-and-evaluation-inputs)
4. [Deficiency description](#4-deficiency-description)
5. [Affected accounts, assertions and components](#5-affected-accounts-assertions-and-components)
6. [Likelihood: reasonable possibility](#6-likelihood-reasonable-possibility)
7. [Magnitude of potential misstatement](#7-magnitude-of-potential-misstatement)
8. [Compensating controls](#8-compensating-controls)
9. [Indicators of a material weakness and the prudent official test](#9-indicators-of-a-material-weakness-and-the-prudent-official-test)
10. [Aggregation with other deficiencies](#10-aggregation-with-other-deficiencies)
11. [Classification decision](#11-classification-decision)
12. [Communication and reporting](#12-communication-and-reporting)
13. [Remediation plan and retest](#13-remediation-plan-and-retest)
14. [Deficiency register and traceability](#14-deficiency-register-and-traceability)
15. [Sign-off](#15-sign-off)
16. [Glossary and references](#16-glossary-and-references)

## 1. Purpose, scope and basis

<!-- Guidance: State which regime the classification serves, because the consequences differ. Under SEC rules a material weakness forces an "ineffective" conclusion; under the UK Code the board describes material controls that did not operate effectively; under the Green Book the agency reports deficiencies in its assurance statement. Pitfall: copying US vocabulary into a UK report without explaining the scale. -->

This working paper records management's evaluation of the severity of
internal control deficiencies identified during [FY2026] and still
relevant at the assessment date. It decides, for each deficiency and for
combinations of deficiencies, whether the matter is a control
deficiency, a significant deficiency or a material weakness, and it
records the evidence, the reasoning, the people informed and the
remediation agreed.

Scope covers controls over financial reporting for the consolidated
financial statements of [Entity name] and every in-scope component
listed in the scoping memo. Operational, compliance and reporting
controls that the board has designated as material controls are
evaluated here when a deficiency could affect financial reporting; other
material-control failures are evaluated in the material controls
declaration working paper (`compliance/material-controls-declaration`).

| Regime | Applies to | Effect of the classification | Applies to *Example* entity |
|---|---|---|---|
| SEC Regulation S-K Item 308 (domestic filers) or Form 20-F Item 15 (foreign private issuers), with Exchange Act Rules 13a-15 / 15d-15 | SEC registrants filing annual reports | One or more material weaknesses means management may not conclude ICFR is effective; each material weakness is disclosed | Yes, Form 20-F Item 15 |
| Exchange Act Rules 13a-14 / 15d-14 (officer certifications) | SEC registrants | Significant deficiencies and material weaknesses are disclosed to the auditor and the audit committee | Yes, Form 20-F exhibits 12 and 13 |
| PCAOB AS 2201 | Auditors performing an ICFR audit integrated with the financial statement audit (required for accelerated and large accelerated filers under SOX 404(b)) | Auditor forms its own severity view and communicates in writing | Yes, accelerated filer, integrated audit (name only) |
| UK Corporate Governance Code 2024, Provision 29 | Companies applying the Code, periods beginning on or after 2026-01-01 | Board declaration on material controls; controls not operating effectively are described with actions | Yes, first year FY2026 |
| ISA (UK) 265 | Auditors of UK and other ISA-based audits | Auditor communicates significant deficiencies in writing to those charged with governance | Yes (auditor side, name only) |
| GAO Green Book 2025, Principle 17 | US federal entities; voluntary reference for others | Issues are reported, evaluated and corrected on a timely basis | Used as the public-domain reference model |

Corvid applies the SEC severity definitions because they bind its Form
20-F ICFR report, and it reuses the same scale for financial reporting
controls in the Provision 29 declaration, so the board, the audit
committee and the auditor read one set of ratings. A company that is
not an SEC registrant can adopt the same scale as an internal policy;
record that choice here, and treat the SEC-specific reporting steps in
section 12 as optional.

## 2. Severity scale and definitions

<!-- Guidance: Put the definitions in front of the reviewer so every conclusion can be checked against the same words. The SEC definitions are public law and may be summarised; do not copy PCAOB or COSO wording into the file. -->

A **deficiency** exists when the design or operation of a control does
not allow management or employees, in the normal course of their
assigned functions, to prevent or detect misstatements on a timely
basis. A design deficiency means a necessary control is missing or,
even if it operates as designed, would not meet its objective. An
operating deficiency means a well-designed control did not run as
designed, or the person running it lacked the authority or competence to
do so effectively.

The SEC definitions in 17 CFR 210.1-02(a)(4), summarised:

| Severity | SEC definition (summary) | Corvid internal rating | Who must know |
|---|---|---|---|
| Control deficiency | Any deficiency that is not a significant deficiency or a material weakness | Low | Process owner, internal control team |
| Significant deficiency | A deficiency, or a combination, that is less severe than a material weakness yet important enough to merit attention by those responsible for oversight of financial reporting | Medium | CFO, audit committee, external auditor |
| Material weakness | A deficiency, or a combination, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis | High | Board, audit committee, external auditor; disclosed publicly by SEC registrants |

"Reasonable possibility" means the likelihood is either reasonably
possible or probable, in the sense used by US contingency accounting
(SEC Release 33-8810, footnote 47). The release states that the
judgement can be made without putting a percentage on the probability.
Severity depends on what could happen, not on whether a misstatement
actually occurred.

## 3. Materiality and evaluation inputs

<!-- Guidance: Record the materiality figures used for the financial statement audit and any lower amounts for sensitive accounts. List every source of deficiencies so nothing is evaluated in a silo. Pitfall: using a materiality figure that has not been updated for the final results. -->

Set out the quantitative anchors and the full population of deficiencies
before rating any one of them. All amounts in EUR thousand unless
stated.

| Input | Value | Basis | Source |
|---|---|---|---|
| Overall materiality (annual) | [Amount] | [Benchmark and percentage] | [Group audit planning memo] |
| *Example:* overall materiality | 700 | 0.5% of FY2026 latest-estimate revenue of EUR 140,000k (140,000 x 0.5% = 700; *Example* policy choice, not a rule), the same figure as the auditor's group materiality | Planning memo PM-2026 |
| Interim materiality (if quarterly reporting) | [Amount] | [Basis] | [Memo] |
| "Clearly trivial" threshold | [Amount] (*Example:* 35, 5% of overall materiality) | [Policy] | [Memo] |
| Specific lower materiality | [Account, amount] (*Example:* related-party and directors' remuneration disclosures, qualitative) | [Reason] | [Memo] |

Sources of deficiencies included in this evaluation:

| Source | Period covered | Number of open items | Reference |
|---|---|---|---|
| Management testing (first and second line) | [Q1 to Q4] | [n] | [Testing tracker] |
| Internal audit reports | [Period] | [n] | [Report IDs] |
| External auditor findings (interim and final) | [Period] | [n] | [Management letter] |
| Misstatements found by the close process or the auditor | [Period] | [n] | [Summary of misstatements] |
| Self-reported incidents and whistleblowing cases with a control angle | [Period] | [n] | [Case log] |
| Service organisation reports (SOC 1 / ISAE 3402 exceptions) | [Period] | [n] | [Report list] |

Every deficiency in the register in section 14 must trace back to one of
these sources. When the external auditor reports a deficiency that
management had not identified, record it here as well, because the fact
that management's own monitoring missed it is evidence about the
monitoring component.

## 4. Deficiency description

<!-- Guidance: Describe one deficiency per block. Answer: which control, what it should do, what was found, how often, since when, who found it, and how it was found. Keep facts and judgement apart. Pitfall: describing the symptom (an error) without naming the control that failed. -->

Complete one block per deficiency. The fields below are the minimum a
reviewer needs to agree or challenge the rating.

| Field | Entry |
|---|---|
| Deficiency ID | [DEF-YYYY-NNN] |
| Control ID and name | [From the risk and control matrix] |
| Control objective | [What the control is meant to prevent or detect] |
| Control type | [Preventive / Detective; Manual / Automated / IT-dependent manual] |
| Frequency | [Per transaction / Daily / Weekly / Monthly / Quarterly / Annual] |
| Nature | [Design / Operating] |
| Description of the condition | [Facts only] |
| Period affected | [From date to date] |
| How identified | [Test, audit, incident, auditor] |
| Root cause | [People / Process / Technology / Data; short explanation] |
| Misstatement actually found | [None / Amount and whether corrected] |

*Example* (DEF-2026-001):

| Field | Entry |
|---|---|
| Deficiency ID | DEF-2026-001 *(Example)* |
| Control ID and name | CTL-REV-007, monthly review of manual deferral journals, Corvid Commerce Inc (CC-US) |
| Control objective | Manual journals that move billed amounts into or out of deferred revenue are complete, accurate and supported by contract data before month-end close |
| Control type | Detective, IT-dependent manual: relies on the ERP journal listing IPE-019 and a billing report by contract (information produced by the entity) |
| Frequency | Monthly |
| Nature | Operating |
| Description of the condition | Testing in the Q3 cycle covered the full population to date, the 8 monthly reviews for January to August 2026. The review was not performed or evidenced for March 2026 and July 2026 (2 of 8). In both months the journals were posted by the revenue accountant without independent review. |
| Period affected | 2026-03 and 2026-07 |
| How identified | Management testing by the internal control team, Q3 cycle, workpaper TW-2026-REV-007, 2026-09-18 |
| Root cause | People: US controller post vacant from 2026-02-20 to 2026-08-04 and no delegate named. The group financial controller covered April to June; no cover was arranged for the March and July closes |
| Misstatement actually found | None. Internal control team re-performed both months; differences below the clearly trivial threshold |

Two further deficiencies are open over the same period and are carried
into the aggregation in section 10:

- DEF-2026-002 *(Example)*: ITG-ACC-002, quarterly review of privileged
  access to the group ERP, not performed for the company code of
  Corvid Commerce Vietnam LLC (CC-VN) in Q2 2026. Three former
  contractors kept administrator rights for 41 days after leaving,
  because contractors were outside the leaver feed of ITG-ACC-003.
  Found by internal audit (report IA-2026-07, issued 2026-09-22).
  Operating deficiency, with a design gap in the leaver feed.
- DEF-2026-003 *(Example)*: CTL-REV-004, monthly group deferred revenue
  roll-forward review by the head of revenue accounting. In July 2026 a
  delegate signed the roll-forward without investigating an adjustments
  line of EUR 62k, above the EUR 50k threshold. Found by internal audit
  testing on 2026-09-25 (workpaper TW-2026-REV-004, exception EX-01;
  extension to April to June found no further exceptions). Operating
  deficiency; no misstatement, as the adjustments were traced to signed
  termination notices.

## 5. Affected accounts, assertions and components

<!-- Guidance: Map each deficiency to the line items and disclosures it could affect, the assertions at risk and the internal control component it sits in. This mapping drives the aggregation in section 10. Pitfall: listing only the account where the error was found, not every account the failed control protects. -->

| Deficiency | Accounts and disclosures | Assertions at risk | Control component (framework name) | Green Book principle |
|---|---|---|---|---|
| DEF-2026-001 *(Example)* | Revenue; deferred revenue (contract liabilities); revenue disaggregation note | Accuracy, cut-off, occurrence | Control activities | Principle 10 (design control activities) |
| DEF-2026-002 *(Example)* | Accounts recorded in the CC-VN company code of the group ERP (capitalised development costs, payroll, intercompany recharges) | Occurrence, accuracy | Control activities (IT general controls) | Principle 11 (design general control activities over information technology) |
| DEF-2026-003 *(Example)* | Deferred revenue (contract liabilities); subscription revenue | Valuation or allocation, completeness | Control activities; monitoring (review by a delegate not checked) | Principle 10 |
| [DEF-ID] | [Accounts] | [Assertions] | [Component] | [Principle number] |

Use the component names of the framework stated in Document control.
When the framework is COSO, cite component names and principle numbers
only. The Green Book 2025 uses the same five-component, seventeen
principle architecture and is public domain, so its principle titles may
be cited in full.

Also note any deficiency that touches the control environment, risk
assessment, information and communication or monitoring components.
Deficiencies outside control activities are often pervasive: they can
undermine many process-level controls at once, so they weigh more
heavily in the severity judgement and in aggregation.

## 6. Likelihood: reasonable possibility

<!-- Guidance: Work through the risk factors named in SEC Release 33-8810, Section II.B.1, and record a short reasoned answer for each. You do not need a percentage. Pitfall: concluding "remote" because no error was found, which the release rejects. -->

For each deficiency, consider the factors below, which summarise the
list in Release 33-8810. Record the answer and the evidence, then reach
a single conclusion: is there a reasonable possibility that the
company's controls will fail to prevent or detect a misstatement of the
amounts or disclosures affected?

| Risk factor (summary) | DEF-2026-001 *(Example)* assessment |
|---|---|
| Nature of the reporting elements involved (for example suspense accounts and related-party items carry more risk) | Deferred revenue is a judgemental balance driven by contract terms; moderate risk |
| Susceptibility of the asset or liability to loss or fraud | Revenue is a presumed fraud risk area in the audit; journals were posted by one person without review |
| Subjectivity, complexity or judgement in determining the amount | Moderate: start dates, billing in advance, mid-term upgrades |
| Interaction with other controls (interdependent or redundant) | Two layers above it: the group roll-forward review CTL-REV-004 (EUR 50k precision), which operated in March but failed in July (DEF-2026-003), and the group analytics CTL-REV-008 (EUR 250k precision); see section 8 |
| Interaction of deficiencies affecting the same amounts | DEF-2026-003 affects the same balance in the same month (July 2026), see section 10 |
| Possible future consequences | Recurrence likely while the role is vacant or covered without delegation |
| **Conclusion** | Reasonable possibility of a misstatement: **Yes** |

The question at this stage is whether a misstatement of any size could
go undetected, not yet whether it would be material. Magnitude is
assessed separately in section 7, and the two answers combine to the
rating.

## 7. Magnitude of potential misstatement

<!-- Guidance: Estimate how large a misstatement could get, not how large the error found was. Use the amounts exposed and the volume of activity. Show the arithmetic. Pitfall: using the actual error (often zero) as the magnitude. -->

Release 33-8810 points to two drivers of magnitude: the amounts or total
transactions exposed to the deficiency, and the volume of activity in
the current period or expected in future periods. It also notes that an
overstatement is generally capped by the recorded amount while an
understatement can be larger, and that small errors are usually more
likely than large ones.

Use a simple exposure calculation and state every input:

$$
\text{Gross exposure} = \sum_{m \in M} J_m
$$

where $M$ is the set of months in which the control failed and $J_m$ is
the gross value of manual deferral journals posted in month $m$.

*Example* (DEF-2026-001, EUR thousand):

| Month | Manual deferral journals posted (gross) | Reviewed? |
|---|---|---|
| 2026-03 | 1,150 | No |
| 2026-07 | 1,420 | No |
| **Gross exposure** | **2,570** | |
| Overall materiality | 700 | |
| Exposure as a multiple of materiality | 3.7 times (2,570 / 700 = 3.67) | |

The gross exposure exceeds overall materiality, so before compensating
controls the deficiency could, in principle, lead to a material
misstatement. A realistic upper estimate is lower: re-performance found
no error, and an error would most likely affect part of a month's
journals rather than all of them. Record the estimate you rely on and
why. Corvid records a "reasonably possible" misstatement of up to the
July journal value of EUR 1,420k, still above materiality, which means
the conclusion turns on the compensating controls in section 8. For
March the group roll-forward review CTL-REV-004 operated at EUR 50k
precision (sample S1 in TW-2026-REV-004 passed), so the exposure that
remains after compensating controls is the July month.

## 8. Compensating controls

<!-- Guidance: A compensating control reduces severity only if it was tested and operates at a precision that would catch a misstatement that could be material. Record precision explicitly. Pitfall: citing a high-level analytical review that would only notice an error several times materiality. -->

Release 33-8810 describes a compensating control as one that achieves
the objective of a control that failed, and requires it to operate at a
level of precision that would prevent or detect a misstatement that
could be material. Test both conditions and record the evidence.

| Compensating control | Objective covered | Precision (threshold for investigation) | Tested? Result | Effect on severity |
|---|---|---|---|---|
| CTL-REV-008 *(Example)*: group monthly revenue and deferred revenue analytics by entity and product, prepared by group FP&A and reviewed by the group financial controller | Unusual movements in US deferred revenue | Variances above EUR 250k against expectation built from billings and the contract schedule | Yes, re-performed for the US entity line for all 9 months January to September 2026, no exceptions (TW-2026-REV-008) | Precision below materiality (250 < 700): reduces the possible undetected misstatement below materiality |
| CTL-REV-004 *(Example)*: group deferred revenue roll-forward review | Unusual credits, cancellations and adjustments in the balance | Movement against expectation above EUR 50k, or adjustments line above EUR 50k | Passed in March (S1), failed in July (DEF-2026-003) | Compensates for March only; no effect for July |
| CTL-REV-003 *(Example)*: monthly reconciliation of the billing sub-ledger to ERP revenue and deferred revenue | Completeness of transfer to the ledger | Differences above EUR 5k | Yes, no exceptions | None: a manual deferral journal is entered in both the sub-ledger and the ERP, so the reconciliation cannot show whether the journal itself is right |
| [Control ID] | [Objective] | [Threshold] | [Test reference] | [Effect] |

Write the reasoning in a sentence or two: Corvid concludes that
CTL-REV-008 would have detected any misstatement from the unreviewed
journals that approached materiality, because it investigates every
variance above EUR 250k and was tested as operating effectively in the
affected months. The deficiency is therefore not a material weakness on
its own.

A control only compensates if it does not depend on the failed control.
Here CTL-REV-008 builds its expectation from billing data in the
subscription system, not from the journals posted by the revenue
accountant, so it is independent.

## 9. Indicators of a material weakness and the prudent official test

<!-- Guidance: Check every indicator explicitly and record "not present" with evidence. Then apply the prudent official test as a final cross-check. Pitfall: skipping this section when the quantitative analysis looks comfortable. -->

Release 33-8810 lists situations that management should treat as
evidence of a deficiency and consider as a possible material weakness.
Answer each one for the period, not just for the deficiency in hand.

| Indicator (summary of Release 33-8810, Section II.B.1) | Present? | Evidence |
|---|---|---|
| Fraud by senior management, of any size (senior management includes the officers who sign the certifications and others with a significant role in financial reporting) | [Yes / No] (*Example:* No) | [Whistleblowing log, investigations register] |
| Restatement of previously issued financial statements to correct a material misstatement | [Yes / No] (*Example:* No) | [Prior-period error review] |
| A material misstatement in the current period found in circumstances showing the company's controls would not have caught it | [Yes / No] (*Example:* No) | [Summary of audit misstatements] |
| Ineffective oversight of external financial reporting and internal control by the audit committee | [Yes / No] (*Example:* No) | [Committee effectiveness review] |

**Prudent official test.** The release asks management to consider the
level of detail and degree of assurance that would satisfy prudent
officials in the conduct of their own affairs that transactions are
recorded as needed to prepare financial statements in accordance with
the applicable framework. If the deficiency, alone or combined, might
stop such an official from reaching that view, treat it as an indicator
of a material weakness.

Record the answer as a short paragraph. *Example:* "A prudent official
reviewing the US revenue process, knowing that two months of journals
went unreviewed but that the group roll-forward review covered March
and group analytics at EUR 250k precision operated in every month,
would still have reasonable
assurance that revenue is recorded properly. The test does not indicate
a material weakness."

## 10. Aggregation with other deficiencies

<!-- Guidance: Group open deficiencies by account or disclosure, by assertion and by control component, then judge each group as a whole. A group can be more severe than any member. Pitfall: aggregating only deficiencies with the same root cause; the SEC test is about effect on the same amounts. -->

Release 33-8810 asks management to evaluate deficiencies that affect the
same financial statement amount or disclosure, or the same component of
internal control, to decide whether together they amount to a material
weakness. Multiple deficiencies over the same amount raise the
likelihood of a misstatement even when each one is minor.

| Aggregation group | Deficiencies | Individual ratings | Combined likelihood | Combined magnitude | Group rating |
|---|---|---|---|---|---|
| AGG-01 *(Example)*: revenue and deferred revenue | DEF-2026-001, DEF-2026-003 | Control deficiency (001 after compensating controls), control deficiency (003) | Reasonable possibility: in July 2026 both the entity review and the group roll-forward review over the same balance failed | Up to 1,420 of unreviewed US journals in July, with no EUR 50k layer above them that month; CTL-REV-008 still detects at 250 precision | **Significant deficiency** |
| AGG-02 *(Example)*: IT general controls, ERP privileged access (CC-VN) | DEF-2026-002 | Control deficiency | Reasonable possibility only if the accounts were used; log analysis for the 41 days found no entries or configuration changes by them | Limited: CC-VN is a cost-plus development service provider, total costs EUR 3,900k in FY2026 | Control deficiency |
| AGG-03 *(Example)*: control activities component, group-wide | DEF-2026-001, 002, 003 | As above | Absence cover for reviewers is a shared cause of 001 and 003, already captured in AGG-01; 002 has a different cause (contractors outside the leaver feed) | Not additive across unrelated accounts | No pervasive deficiency beyond AGG-01 |
| [AGG-NN] | [IDs] | [Ratings] | [Assessment] | [Assessment] | [Rating] |

Write one paragraph per group explaining the result. *Example* AGG-01:
"Both deficiencies weaken the review of the same balance in the same
month, July 2026, and both arose because a reviewer was absent without
effective cover. Neither alone could plausibly cause a material error,
because CTL-REV-008 operates at EUR 250k precision. Together they left
the group reliant on a single analytical backstop for a presumed
fraud-risk account. Management judges this important enough to merit the attention
of the audit committee and rates the combination a significant
deficiency. It is not a material weakness because the backstop was
tested and is precise enough."

## 11. Classification decision

<!-- Guidance: Use the decision flow to make the reasoning visible and consistent between evaluators. The diagram is a reasoning aid, not a substitute for judgement. Pitfall: stopping at the first "no" without checking the indicators and aggregation. -->

```mermaid
flowchart TD
    A[Deficiency identified and described] --> B{Reasonable possibility of a misstatement in any amount or disclosure?}
    B -- No --> CD[Control deficiency]
    B -- Yes --> C{Could the potential misstatement be material, before compensating controls?}
    C -- No --> SDQ{Important enough to merit attention of those overseeing financial reporting?}
    C -- Yes --> D{Tested compensating control at a precision below materiality?}
    D -- Yes --> SDQ
    D -- No --> MW[Material weakness]
    SDQ -- Yes --> SD[Significant deficiency]
    SDQ -- No --> CD
    CD --> E{Indicators or prudent official test triggered?}
    SD --> E
    E -- Yes --> MW
    E -- No --> F[Carry the rating into aggregation, section 10]
    F --> G{Group rating more severe?}
    G -- Yes --> H[Use the group rating for reporting]
    G -- No --> I[Use the individual rating]
```

| Deficiency | Individual rating | Group | Final rating used for reporting | Rationale reference |
|---|---|---|---|---|
| DEF-2026-001 *(Example)* | Control deficiency | AGG-01 | Significant deficiency (as part of AGG-01) | Sections 7, 8, 10 |
| DEF-2026-002 *(Example)* | Control deficiency | AGG-02 | Control deficiency | Sections 5, 10 |
| DEF-2026-003 *(Example)* | Control deficiency | AGG-01 | Significant deficiency (as part of AGG-01) | Section 10 |

When the evaluator and the reviewer disagree, record both views and the
final decision maker. When the external auditor reaches a different
rating, record the auditor's view, the reasons for any remaining
difference and how the audit committee was informed.

## 12. Communication and reporting

<!-- Guidance: Record who was told, when, and in what form. Timeliness matters as much as content. Pitfall: telling the audit committee about a significant deficiency only after year end when it was known in Q3. -->

| Audience | What is communicated | When | Evidence | Regime |
|---|---|---|---|---|
| Process owner and entity controller | Every deficiency, root cause, remediation owner | Within [5] business days of identification | Ticket in remediation tracker | Internal policy; Green Book Principle 17 |
| CFO and disclosure committee | Significant deficiencies and material weaknesses, and aggregated groups | Next disclosure committee meeting, at most [30] days | Minutes | Internal policy |
| Audit committee | Significant deficiencies and material weaknesses; status of all remediation | Next scheduled meeting, or immediately for a material weakness | Committee paper and minutes | UK Code Provisions 25 and 29; Rule 13a-14 certifications (Corvid files Form 20-F) |
| External auditor | All deficiencies identified by management | When identified and at each audit phase | Shared register | ISA (UK) 265 / PCAOB AS 2201 (names only) |
| Board | Material weaknesses; material controls not operating effectively | Before approval of the annual report | Board paper | UK Code Provision 29 |
| Investors (annual report and Form 20-F) | Material controls not operating effectively and actions (UK); material weaknesses with nature, impact and remediation (SEC) | Annual report; Form 20-F Item 15 | Annual report section | Provision 29; Item 308(a)(3) / Form 20-F Item 15(b) |

**SEC reporting (Corvid, Form 20-F).** Item 308(a)(3), mirrored for
foreign private issuers in Form 20-F Item 15(b), requires disclosure of any
material weakness identified by management and bars an "effective"
conclusion when one exists. Release 33-8810 adds that management should
not qualify its conclusion ("effective except for") and should consider
disclosing the nature of the weakness, its impact on financial reporting
and on internal control, and current remediation plans, distinguishing
pervasive weaknesses from narrower ones. Significant deficiencies are
not required in the Item 308(a) report but are disclosed to the auditor
and the audit committee under the certification rules. Item 308(c) asks
for disclosure of material changes in internal control in the last
fiscal quarter (Form 20-F Item 15(d): the period covered by the annual
report), which can include remediation of a material weakness. A
company that uses this scale without being an SEC registrant can skip
this paragraph.

*Example* communications log:

| Date | Audience | Item | Form | By |
|---|---|---|---|---|
| 2026-09-18 *(Example)* | US entity controller and group financial controller | DEF-2026-001 identified | Email and tracker entry | Internal control lead |
| 2026-09-22 *(Example)* | CIO, Vietnam finance director | DEF-2026-002 reported in IA-2026-07; access removed 2026-09-23 | Internal audit report | Head of internal audit |
| 2026-09-25 *(Example)* | Head of revenue accounting, group financial controller | DEF-2026-003 identified (EX-01) | Workpaper TW-2026-REV-004 and tracker entry | Internal audit |
| 2026-10-14 *(Example)* | Audit committee, Q3 meeting | AGG-01 rated significant deficiency; remediation plan | Committee paper AC-2026-Q3-06 | CFO |
| 2026-10-14 *(Example)* | External auditor | Full deficiency register | Shared register extract | Internal control lead |
| 2026-12-16 *(Example)* | Audit committee chair, written update between meetings | Remediation retests passed for all three deficiencies (completed 2026-12-15) | Update note AC-2026-12-U1 | Head of internal control |
| 2027-02-24 *(Example)* | Audit committee, year-end meeting | December roll-forward results; no open significant deficiency at year end | Paper AC-2027-02-04 | CFO |

## 13. Remediation plan and retest

<!-- Guidance: Each deficiency needs an owner, actions, a due date and a retest that proves the fixed control operated for long enough before the assessment date. Pitfall: declaring remediation complete on the day the new control was designed. -->

A deficiency counts as remediated at the assessment date only when the
redesigned or restored control has operated for a long enough period and
has been tested with satisfactory results. Set the minimum operating
period by control frequency before remediation starts, so the deadline
for a clean year-end position is known.

| Control frequency | Minimum operating period before retest (*Example* policy) | Minimum retest sample (*Example* policy) |
|---|---|---|
| Annual | One occurrence | 1 |
| Quarterly | Two quarters | 2 |
| Monthly | Two months | 2 |
| Weekly | Five weeks | 5 |
| Daily or per transaction | 30 days | [Per sampling policy] |

| Deficiency | Action | Owner | Due | Retest window | Retest result | Status |
|---|---|---|---|---|---|---|
| DEF-2026-001 *(Example)* | Name a delegate for every key review control; add a close checklist step that blocks sign-off until the review of CTL-REV-007 is evidenced | [@us-controller] | 2026-10-15 | October and November 2026 closes, retested by 2026-12-15 | Passed, 2 of 2 (TW-2026-REV-007 v1.1) | Remediated |
| DEF-2026-002 *(Example)* | Remove the three accounts (done 2026-09-23); add contractors to the ITG-ACC-003 leaver feed; perform ITG-ACC-002 monthly instead of quarterly from October 2026 to March 2027 | [@it-security-lead] | 2026-09-30 | October and November 2026 monthly reviews, retested by 2026-12-15 | Passed, 2 of 2 (monthly minimum); December review in roll-forward | Remediated |
| DEF-2026-003 *(Example)* | CTL-REV-004 version 2 from 2026-10-01: stated threshold basis and written investigation with support before sign-off; delegate briefed and listed | [@head-of-revenue-accounting] | 2026-10-01 | October and November 2026, retested by 2026-12-15 | Passed, 2 of 2 (TW-2026-REV-004 v1.1); December passed 2027-01-12 | Remediated |
| [DEF-ID] | [Action] | [@owner] | YYYY-MM-DD | [Window] | [Result] | [Open / Remediated / Not remediated at year end] |

Mind the calendar. A control for December operates in the January
close, so no retest of December can finish before the year end. Base
the remediation conclusion on retests of the months that can be tested
before year end (here October and November, completed by 2026-12-15),
and then confirm the December operation in roll-forward testing
completed before the assessment is signed (here by 2027-01-31).

For a deficiency still open at the assessment date, keep the year-end
rating, record the expected remediation date and carry it into the next
period's register. Never re-rate a deficiency downwards at year end
because remediation is "in progress".

## 14. Deficiency register and traceability

<!-- Guidance: Keep one register for the period and trace each line back to its source and forward to reporting. Use stable IDs. Pitfall: renumbering deficiencies between quarters, which breaks the audit trail. -->

| ID | Source | Control | Accounts | Individual rating | Group | Final rating | Reported to | Remediation status at year end |
|---|---|---|---|---|---|---|---|---|
| DEF-2026-001 *(Example)* | Management testing, TW-2026-REV-007 | CTL-REV-007 | Revenue, deferred revenue | CD | AGG-01 | SD | CFO, AC, auditor | Remediated, retested |
| DEF-2026-002 *(Example)* | Internal audit IA-2026-07 | ITG-ACC-002 | CC-VN company code accounts | CD | AGG-02 | CD | Process owner, AC (register), auditor | Remediated, retested |
| DEF-2026-003 *(Example)* | Internal audit testing, TW-2026-REV-004 | CTL-REV-004 | Deferred revenue, revenue | CD | AGG-01 | SD | CFO, AC, auditor | Remediated, retested |
| [DEF-ID] | [Source] | [Control] | [Accounts] | [Rating] | [Group] | [Rating] | [Audiences] | [Status] |

Traceability to the material controls declaration: CTL-REV-004 and
CTL-REV-007 support material control MC-003 (revenue and deferred
revenue) in `compliance/material-controls-declaration`; ITG-ACC-002
supports MC-007 (access to financial systems). The declaration working
paper cites these IDs and the remediation evidence, and the ICFR
management assessment (`compliance/icfr-management-assessment`, section
9) carries the same register.

Summary at the assessment date (*Example*): three deficiencies
identified during the year; one aggregated significant deficiency
(AGG-01); no material weaknesses; all three remediated by 2026-12-31,
with remediation retests completed by 2026-12-15 and the December
operation confirmed in roll-forward testing completed by 2027-01-31.

## 15. Sign-off

<!-- Guidance: The preparer, reviewer and CFO sign the final version. The audit committee notes the conclusion. Pitfall: signing before the external auditor's final view is known and reconciled. -->

| Statement | Signed by | Date |
|---|---|---|
| The deficiencies listed in section 14 are complete for the sources in section 3 | [@preparer] | YYYY-MM-DD |
| The ratings follow the definitions in section 2 and the reasoning in sections 6 to 11 | [@reviewer] | YYYY-MM-DD |
| Management accepts the final ratings and the remediation status | [@cfo] | YYYY-MM-DD |
| Differences with the external auditor's view are resolved or recorded in section 11 | [@cfo] | YYYY-MM-DD |

## 16. Glossary and references

<!-- Guidance: Define terms the board and audit committee will read in the summary. Keep references to the numbers and names of standards; obtain the current texts. -->

| Term | Meaning in this template |
|---|---|
| Aggregation | Evaluating several deficiencies together because they affect the same amount, disclosure or component |
| Compensating control | A control that achieves the objective of a control that failed, at enough precision to catch a material error |
| ICFR | Internal control over financial reporting (defined for SEC registrants in Rules 13a-15(f) and 15d-15(f)) |
| IPE | Information produced by the entity, such as a system report used in a control |
| Material control | A control the board judges material to the company, for the UK Code Provision 29 declaration |
| Precision | The size of error a control would reliably detect |
| Remediation | Fixing a deficiency and proving the fix operated for a sufficient period |

References (obtain current versions):

- 17 CFR 210.1-02(a)(4), definitions of material weakness and significant deficiency (Regulation S-X), eCFR.
- 17 CFR 229.308 (Regulation S-K Item 308), management's report on internal control over financial reporting, eCFR; SEC Form 20-F, Item 15 (foreign private issuers).
- 17 CFR 240.13a-14, 13a-15, 15d-14 and 15d-15 (Exchange Act rules on certifications and controls).
- SEC Release No. 33-8810; 34-55929; FR-77, "Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934", dated 2007-06-20, effective 2007-06-27.
- GAO, Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721, 2025-05-15, effective from fiscal year 2026; supplement GAO-26-109325.
- UK Corporate Governance Code 2024 (FRC), Provisions 25 and 29, and the accompanying Corporate Governance Code Guidance (names only).
- PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements; ISA (UK) 265 (names only).
- COSO Internal Control, Integrated Framework (2013) (name only).
- Related templates: ICFR Management Assessment (`compliance/icfr-management-assessment`), Risk and Control Matrix (`compliance/risk-control-matrix`), Control Testing Workpaper (`compliance/control-testing-workpaper`), Material Controls Declaration (`compliance/material-controls-declaration`), Audit Committee Report (`finance/audit-committee-report`), Fraud Risk Assessment (`compliance/fraud-risk-assessment`).

## Standard and licence note

Based on public US law and guidance: SEC Regulation S-X Rule 1-02,
Regulation S-K Item 308 and SEC Release No. 33-8810 (US government
works), with the GAO Green Book 2025 (US government work) as the
public-domain internal control reference, all summarised in original
wording. The UK Corporate Governance Code 2024, PCAOB AS 2201, ISA (UK)
265 and the COSO Internal Control framework are cited by name and number
only; no text, definition or illustration from them is reproduced or
paraphrased. This template is not affiliated with or endorsed by the
SEC, GAO, FRC, PCAOB, IAASB or COSO. All names and figures in the
examples are fictional. This template is original text written for this
collection. Check the current official versions before use. Template
licence: MIT.