Entity or part of organization structure subject to the assessment (entity, division, operating unit, function)

Objective(s) being considered for the scope of internal control being assessed

Considerations regarding management's acceptable level of risk

Operations

Reporting

Compliance

Present? (Y/N)

Functioning? (Y/N)

Explanation/Conclusion

Control Environment

Risk Assessment

Control Activities

Information and Communication

Monitoring Activities

Are all components operating together in an integrated manner?

Evaluate if a combination of internal control deficiencies, when aggregated across components, represent a major deficiency*

<Update Summary of Deficiencies Template as needed>

Is the overall system of internal control effective? <Y/N>*

Basis for conclusion