Issues

SOX Deficiency Evaluation

The Deficiency Agent evaluates likelihood and magnitude, considers compensating controls, and aggregates related matters. The severity conclusion is always a human decision.

1 severity to conclude

Deficiencies FY26

Q3 to date

Significant deficiencies

1 pending your decision

Material weaknesses

None identified

Aggregation groups

Revenue, ITGC

DE-31 — credit memo approval bypass

Awaiting human conclusion

Control R2C-014→Exception EX-119→Full population→Deficiency DE-31→Your decision→Finding F-2074→Audit Committee

Deficiency Agent

Likelihood is reasonably possible (the routing gap persisted for 6 weeks); magnitude is more than inconsequential at $1.9M gross and $0.4M net, below the $21.4M materiality. FCR-003 detected 5 of 7 occurrences, so the compensating control reduces but does not eliminate the risk. Aggregated with DE-28, combined exposure is $2.4M — a significant deficiency, not a material weakness.

All deficiencies

Deficiency	Exception	Control	Likelihood	Magnitude	Compensating control	AI conclusion	Human decision	Aggregation
DE-31	EX-119	R2C-014	Reasonably possible	More than inconsequential	FCR-003 monthly revenue analytic review detected 5 of 7 occurrences	Significant deficiency	Pending	Evaluated with DE-28 — combined gross exposure $2.4M, below material weakness threshold.
DE-29	EX-117	ITGC-017	Reasonably possible	More than inconsequential	Quarterly privileged access review; no evidence of inappropriate activity	Significant deficiency	Approved	Aggregated with DE-27 for ITGC conclusion; automated controls remain supported.
DE-28	EX-114	P2P-008	Remote	More than inconsequential	Payment release requires two-person approval	Control deficiency	Approved	Individually and in aggregate does not rise to significant deficiency.
DE-27	EX-111	ITGC-009	Remote	Inconsequential	Post-implementation review performed for all major releases	Control deficiency	Approved	Isolated documentation matter; no aggregation impact.