If there are key controls in place operating effectively, AOS auditors would report the lack of the required UG policy as a management letter citation. However, in subsequent audits, evaluate if the noncompliance should be elevated if not adopted. Written policies aid in consistency and adherence to requirements strengthening internal control processes. What Control Procedures Address the Compliance Requirement (reference/link to documentation or the testing was performed): Basis for the control (reports, resources, etc. providing information needed to understand requirements and prevent or identify and correct errors): Control Procedure (description of how auditee uses the to prevent, or identify “Basis” and correct or detect errors): Person(s) responsible for performing the control procedure (title): (i.e. sampling unit): Description of evidence documenting the control was applied
If there are key controls in place operating effectively, AOS auditors would report the lack of the required UG policy as a management letter citation. However, in subsequent audits, evaluate if the noncompliance should be elevated if not adopted. Written policies aid in consistency and adherence to requirements strengthening internal control processes. What Control Procedures Address the Compliance Requirement (reference/link to documentation or the testing was performed): Basis for the control (reports, resources, etc. providing information needed to understand requirements and prevent or identify and correct errors): Control Procedure (description of how auditee uses the “Basis” to prevent, or identify and correct or detect errors): Person(s) responsible for performing the control procedure (title): Description of evidence documenting the control was applied (i.e. sampling unit):