{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:e44e2152e93d96eb220e7ce001a04754f0a770e2bac48d1e711e634c9ff66c45","slug":"sox-deficiency-aggregation-evaluation","url":"/assets/agent_workflow-sox-deficiency-aggregation-evaluation-7b52507a.79cbbcfd0da1c3d0.json"},"kind":"record","record":{"attributes":{"department":"finance","domain":"sox","lineOfDefense":"monitor"},"canonicalUrl":"https://workflow-library.com/all/?w=sox-deficiency-aggregation-evaluation","description":"Year-End Deficiency Aggregation & Severity Evaluation as a modular, decision-aware workflow. The instance runs against the existing fiscal-year ICFR assessment engagement — the Audit item with audit_type=sox_testing whose period_end is fiscal year end — enriching it rather than creating a duplicate: the frozen register snapshot and the full evaluation memo trail attach to its steps, and the overall ICFR conclusion lands on that Audit item (rating/opinion/report_date). It closes the gap between per-deficiency handling and the portfolio view: it freezes the register, reconciles it to every failed test, aggregates related deficiencies, concludes control deficiency versus significant deficiency versus material weakness, and hands conclusions to certification support, remediation, and audit-committee reporting instead of duplicating their work. The named deliverables are the year-end deficiency-evaluation memo (carrying the overall ICFR conclusion) and the countersigned final severity schedule. In scope: freezing and severity-evaluating the year-end deficiency population as of the fiscal-year-end assessment date, kept live through the 10-K filing date under a late-arrival rule. Out of scope, handed off rather than duplicated: fixing the deficiencies (SOX Deficiency Remediation) and reporting them to the board (Quarterly Board & Audit-Committee GRC Reporting). Severity thresholds and the contributing-test population are consumed from the Annual ICFR Scoping & Risk Assessment, SOX Key Control TOD/TOE Test, and SOX ITGC Testing runs — the deficiency register itself is the Issue population (issue_type deficiency, escalating to significant_deficiency and material_weakness as this workflow finalizes).","details":{"canonicalUrl":"https://workflow-library.com/all/?w=sox-deficiency-aggregation-evaluation","capabilities":[],"controls":["UC-RISK-14","UC-AUDIT-14","UC-AUDIT-17","UC-AUDIT-21","UC-GOV-21"],"domains":["sox"],"lineOfDefense":"monitor","mappingStatus":"mapped","releaseId":"sha256:e44e2152e93d96eb220e7ce001a04754f0a770e2bac48d1e711e634c9ff66c45","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:sox-deficiency-aggregation-evaluation","standards":["sox","coso-ic"],"teams":["finance"]},"id":"wf:S16","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AS16","slug":"sox-deficiency-aggregation-evaluation","sourceIds":["cobit-2019","coso-erm","coso-ic","iia-2024","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Year-End Deficiency Aggregation & Severity Evaluation","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:05d66e8976e109b1ebda523e8717182e9404528729a1b98fd72a1c18d6bd145b","properties":{},"sourceDetailPath":"/data/v1/records/wf-s16-ff1d0766.json","sourceId":"wf:S16","targetDetailPath":"/data/v1/records/uc-uc-risk-14-a5d6281b.json","targetId":"uc:UC-RISK-14","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0d8c83f0f15b46b17d8350445b7dbcc50b736d9aeb328a8fb8ce2213749f17ba","properties":{},"sourceDetailPath":"/data/v1/records/wf-s16-ff1d0766.json","sourceId":"wf:S16","targetDetailPath":"/data/v1/records/uc-uc-audit-21-6406caa4.json","targetId":"uc:UC-AUDIT-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b9c2ca8878fa5c9ff9ce6b6324fb5384d4cd02ff0dba9f73ff82079a34e8a89c","properties":{},"sourceDetailPath":"/data/v1/records/wf-s16-ff1d0766.json","sourceId":"wf:S16","targetDetailPath":"/data/v1/records/uc-uc-gov-21-8c5d79f9.json","targetId":"uc:UC-GOV-21","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cd597d768ec220b63cce472a5beb783b2ee046dc0a3bfc86523e136ca92e7717","properties":{},"sourceDetailPath":"/data/v1/records/wf-s16-ff1d0766.json","sourceId":"wf:S16","targetDetailPath":"/data/v1/records/uc-uc-audit-17-94dc7e0c.json","targetId":"uc:UC-AUDIT-17","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e77e2d007dd6d76f1adb7e48413736eeee510041bac2cb0cab3c19c64d4729d1","properties":{},"sourceDetailPath":"/data/v1/records/wf-s16-ff1d0766.json","sourceId":"wf:S16","targetDetailPath":"/data/v1/records/uc-uc-audit-14-5c0dbe8f.json","targetId":"uc:UC-AUDIT-14","type":"oversees"}],"schemaVersion":1}