Internal Control Testing and Deficiency Evaluation

This is a reference model for internal control testing in banks reporting under US SOX 404, including institutions caught by FDICIA Part 363 whether listed or not, and under the UK Corporate Governance Code 2024, Provision 29. The method is the graph and each bank's control inventory is data supplied at query time: given one control, its design attributes, its test results and any deficiency recorded against it, the agent decides whether the control is designed effectively, whether it operated effectively over the period, including sample sufficiency, evidence quality, roll-forward and reliance on IT general controls and entity-produced information, and how severe any deficiency is, aggregated across related deficiencies. A single framework fact selects the overlay: under SOX 404 the determination is deficiency, significant deficiency or material weakness with the AS 2201 communication route; under Provision 29 it is whether a material control operated effectively at the balance sheet date and what the board's declaration must say. The two vocabularies never blend, every determination names the paragraph it rests on, and an incomplete record produces a question, never a guess.

Grounded in SEC Release 33-8810, PCAOB AS 2201 and AS 2315, FDICIA Part 363, the UK Corporate Governance Code 2024 with the FRC's guidance, ISA (UK) 265, 315 and 330, and COSO 2013: 865 rules each carrying its scope tag and source paragraph, 49 calibration parameters such as sample sizes, roll-forward gaps, remediation periods and the severity grid held as data rather than rules, and 91 tests passing at full certainty.