A major deficiency noted at the division level (or any level below the level at which controls are being evaluated) needs to be evaluated in the context of the entity to determine if a major deficiency exists at the level at which internal controls are being assessed.

Internal control deficiencies need to be evaluated in the context of the stated objective and the company's risk tolerance when consolidated at the entity level.

Management may choose to customize the templates to suit their specific needs depending on the organization and objective.