Accelerator · Documentation

Internal Control Testing and Deficiency Evaluation: Solution Documentation

What the graph decides, how to query it, how to calibrate it and how to deploy it.

for US SOX 404 and UK Corporate Governance Code Provision 29

This pack is released for demonstration and evaluation under the scoped MIT licence. It must be calibrated and validated per institution before any production use. Every figure that varies by institution is a named calibration parameter with a documented default, and several of those defaults are drawn from public practice guidance rather than from a standard. Nothing in this pack is a substitute for an institution's own control testing methodology, its own materiality framework, or the judgement of its second line, internal audit or external auditor. The graph adjudicates one control at a time against the method the public standards state; it does not reach, and must not be read as reaching, a conclusion on a system of internal control, an audit opinion, or any institution's annual report assertion.

The pack contains the knowledge graph (graph.xml: 865 rules, 398 relationships, 60 concepts, 208 instances and 217 parameter facts), the Studio test suite (91 tests including 10 red-team regressions), this document, Regulatory Cross Reference Documentation.md (the requirements register, the source register and the requirement-to-rule coverage map) and the MIT licence.

1. What the graph decides

Three decision points, each independently queryable, each with its own conclusion relationship and its own explanation channel.

	Decision point	Conclusion relationship	Needs test evidence?
DP1	Control design assessment	`has design assessment`	No — control facts alone
DP2	Operating effectiveness adjudication	`has operating effectiveness conclusion`	Yes
DP3	Deficiency evaluation and aggregation	`has us severity determination` (US) / `has uk declaration determination` (UK)	A deficiency record plus judgements

Five sub-decisions sit inside DP1 and DP2 and are separately queryable, because a bank often wants the sub-answer without the whole determination:

Sub-decision	Relationship	Values
Reliance on information produced by the entity	`has ipe reliance availability`	Reliance Available / Not Available / Not Applicable
General IT control reliance (including the test of one)	`has itgc reliance availability`	same three
Management review control precision	`has design finding` (named legs) + `has design assessment`	per-leg findings
Compensating control adequacy	`has compensating control finding` + its effect on the severity ladder	findings plus a reduction marker
Evidence sufficiency	`has evidence sufficiency finding`	one finding per failed sufficiency test

The method is the graph; the controls are the data

The graph holds no control. A bank's control inventory is instance data supplied at query time: the caller names a control, supplies facts against it, and reads the determinations back off the same subject. That is what makes the pack portable between institutions, and it is why the calibration parameters are facts on a policy instance rather than literals inside rules.

What is deliberately out of scope

Scoping and risk assessment (which controls are in scope, which accounts are significant); extraction of facts from unstructured evidence; GRC platform integration; remediation planning beyond stating whether a retest is required and what would discharge it; the external auditor's opinion, walkthroughs, fraud risk assessment and entity-level control evaluation as such; and any specific institution's controls or methodology. The graph also never decides whether an institution is caught by FDICIA Part 363 or is an accelerated filer — the reporting regime is an input.

2. The graph


Size	865 rules, 398 relationships, 60 concepts, 208 instances, 217 parameter facts
Scope tags	441 CORE rules, 247 US rules, 177 UK rules
Linter	0 errors, 0 warnings

3. Jurisdictions and the never-blend guarantee

The core graph encodes the method the two regimes share. A single framework fact — has framework, values US ICFR and UK Material Controls — selects the overlay. ISA (UK) 265 is the bridge between them: it supplies the definitions and the communication duty that both paths recognise, and it carries its own UK-side classification ladder.

The overlays differ only in severity taxonomy and reporting consequence, and they never blend. This is structural, not a matter of rule ordering:

Every overlay rule carries a leading condition binding has framework to its own value, so an overlay rule is unreachable under the other framework.
The two severity vocabularies are different concepts with disjoint instance sets (US Severity and UK Declaration Outcome / International Classification), so neither vocabulary can appear in the other overlay's answer list.
Overlay findings live in separate plural relationships, so a joined summary cannot mix them.
Every overlay reason rule copies the framework condition of the rule it narrates. Governance communication is three rules — a framework-neutral determination, a US citation rule and a UK citation rule — never one rule carrying both citations.

The UK path is wider in scope: Provision 29 reaches financial, operational, reporting and compliance controls, so a UK determination is available on an operational control. The US path is restricted to internal control over financial reporting as defined at 17 CFR 240.13a-15(f): a control outside that definition produces an explicit out-of-scope decline with its reason, not a determination.

Materiality is the board's, not the standard's. On the UK path the material-control designation is an input with no default; the FRC is explicit that prescribing what a material control is, is not its role. On both paths the graph consumes a materiality band, never a money amount.

Version checks

Instrument	Finding
UK Corporate Governance Code	2024 Code used, not 2018. Published 22 January 2024; Provision 29 applies to periods beginning on or after 1 January 2026. The 2018 Code is recorded as superseded and is the source of no rule.
PCAOB AS 2201	The AS No. 5 (2007) text, substantively unamended on every paragraph relied on. QC 1000 amends ¶.09 and adds ¶.99 effective 15 December 2026 — quality-control housekeeping that touches none of the paragraphs here. Recorded as a watch item.
FRC guidance	2024 edition (published 29 January 2024, Section 4 clarified 6 March 2024, last updated 3 June 2026). Paragraph numbering is pinned to the version live on 14 October 2026; the FRC has renumbered it at least once.
ISA (UK) 265 / 315 / 330	Current revisions, all "Updated September 2025", published 25 September 2025. Note that 265's cover says Updated September 2025 while its running footer still reads Revised November 2019; both are recorded.

4. Fact schema

The graph asks for the facts below and nothing else. Three properties hold for every one of them, and were checked row by row: the bank can supply it from its own records; it encodes no conclusion the graph should reach itself; and it names no system, person or product. A performer is a role, never a person.

Askability posture is deliberate and is what makes a fully-injected run question-free:

85 askable facts, all on the Control subject, all askable="secondFormObject" with allowUnknown="true". These are the facts a control owner or tester can genuinely answer.
Everything else is askable="none" — every relationship on Deficiency and on ICFR Assessment, every derived conclusion, every narrative channel, and the eight systems-of-record facts on the control (period end, reporting regime, materiality band, key and material control designation, COSO component, assertion, interim test date). These are injected.
No plural relationship is askable.

H1 — Context and identity

Fact	Posture
Framework overlay (`has framework`)	asked first
Reporting regime	injected
Control scope (financial reporting / operational / reporting / compliance / strategic)	asked
Period end date; assessment date	injected
Risk addressed; assertion; line item; COSO component	risk asked, rest injected
Key control designation	injected
Material control designation	injected (board's judgement)
Materiality band set and the band at issue	injected
Risk level of the control (low / medium / high)	asked
Instrument versions applied	injected
Assessor role (management or second line / internal audit / external auditor)	injected
Acquired in period; assessment feasible before the due date; prior-year exclusion taken	injected

H2 — Design attributes

Performer role; frequency; timing relative to the transaction; procedure described; evidence produced; precision or threshold stated (these six are the required attribute set, each named individually in the output when missing); control type and nature; whether the control addresses the stated risk as described; reliance on an application and on internally produced information; changed during the period and the date of change; performer authority and competence attested; addresses a significant risk; service-organisation dependence and report coverage; entity-level control relied on and its precision tier.

H3 — Management review control attributes

Is a management review control; review threshold band; whether it addresses assertion-level risk; precision factors documented; investigation steps documented; performer authority; information source identified; evidence of steps performed and of conclusions reached; evidenced only by sign-off; is a budget or forecast comparison; account complex or unpredictable; follow-up of outliers documented.

H4 — Test facts

The four procedures as separate flags (inquiry / observation / inspection / re-performance); population size and completeness; sampling method and recorded rationale; sample size tested; exception count, nature and deviation class; root cause identified; untestable items; combinations of controls; performer population count; segregation-of-duties dependence; the evidence attributes (retained, shows what was done, shows the performer, dated within the period, performer independent of preparer); the deviation-response facts; dual-purpose testing; the evidence source class, form and restrictions; prior-year test approach; supersession in period; misstatements the control failed to detect.

H5 — Interim, roll-forward and prior-period facts

Interim test date; roll-forward performed and whether it was inquiry only; changes since interim; exceptions noted at interim; substantially all evidence at interim; interim change enquiry; prior-period evidence relied on and assessments since last tested; relevance inquiry and corroboration; significant manual element; personnel changes affecting the application; circumstances indicating the control must change; control environment and monitoring process deficiencies.

H6 — IT and information facts

The general IT control conclusion for the relied-on application with the scope it covers (the scope attribute is what stops the conclusion being extended by implication); whether those controls are currently tested; unchanged since baseline, baseline age, initial-year assessment; related data table dependence and integrity; whether the IT controls over the data the control uses were tested; the four entity-information tests (completeness and accuracy, query logic, report parameters, sufficiently precise and detailed); and, per relied-on report, its class, IT control conclusion, whether it sits inside the tested scope, parameters checked, unmodified, change management evidenced, reconciled, and other procedures performed.

H7 — Deficiency facts

A deficiency is its own record, linked in both directions (has deficiency from the control and deficiency of control back to it — the US severity ladder reads one direction, the UK declaration ladder the other). On the record: deficiency type; likelihood band; magnitude band; direction of exposure; the four compensating-control facts (exists, same assertion, tested effective, precision adequate); the US indicator facts; the international significance indicators (held separately, so the two postures can never be read from one another); the two ISA judgement inputs; the grouping axes for assertion, for line item, for coso component; pervasiveness; the remediation facts; whether a remediation action is stated; whether it was already communicated in writing; the restatement precedence facts; and the UK-only designations.

Three traps for a caller supplying deficiency data

The grouping axes are spelled differently on the deficiency than on the control. The control carries relates to assertion and sits in coso component; the deficiency carries for assertion, for line item and for coso component. Both sets of relationships exist, so injecting the control-side spelling onto a deficiency is accepted and matches nothing.
Do not inject persists at period end. It is derived. Supply the facts underneath it.
A query result is cached per session. Injecting more facts after a query and re-running the same query returns the first answer. Start a new session for a corrected payload.

5. Which relationships to query

The front doors

Query	Subject	Returns
`has design assessment`	Control	Design Effective / Design Deficient / No Design Determination
`has operating effectiveness conclusion`	Control	Operating Effective / Exception Requiring Evaluation / Not Operating Effectively / Insufficient Evidence / Testing Not Required / No Operating Determination
`has us severity determination`	Deficiency	the three US severity values (see glossary)
`has uk declaration determination`	Control	Material Control Operated Effectively / Material Control Did Not Operate Effectively / Effectiveness Not Determinable / No Declaration Consequence
`has international classification`	Deficiency	Significant Deficiency Reportable To Those Charged With Governance / Deficiency Meriting Management Attention / Deficiency Meriting Neither / Classification Not Determinable
`has communication requirement`	Deficiency	the route and its citation
`has determination`	Control	the umbrella surface: every determination reached on this control, one line each
`has rolled up open question`	Control	everything still outstanding, control-level and deficiency-level

Subject discipline matters. The UK declaration surface is a Control relationship; the international classification and the US severity ladder are Deficiency relationships. Querying one on the other's subject makes the engine ask for has framework on a subject that has none, which looks like a missing-fact question but is a mis-addressed query.

Supporting surfaces

has required sample size, has itgc reliance availability, has ipe reliance availability, has aggregated magnitude band, has effective magnitude band, has retest requirement, has roll forward requirement, has control type confirmed, has effective exception count.

Explanation surfaces

Every decision point has a four-channel explanation layer, and the channels are kept separate on purpose:

... finding (plural) — substantive findings, named individually. A finding is a thing that went wrong or a reliance that was or was not available.
... statement (plural) — method notes and scope caveats that accompany every output. These are not findings, and they are on their own relationships, because a finding count gates a determination and a method note must never move one.
... reason (plural) — why this outcome and not the one above or below it. Negative findings are explained as fully as positive ones: there are explicit rules saying why a deficiency is not the next rung up and why an effective conclusion was available.
... summary (singular) — the plain-language summary for a control owner, within 80 words, composed from the outcome plus bounded counts rather than from joined finding text.
... open question (plural) — what is missing, named, rather than a conclusion on a guess.

Every finding and reason carries its source document and paragraph inline in the text, so the reference is visible in the query result itself and not only in the reasoning tree. Each rule name additionally carries its scope tag, its requirement ID and its source reference, and each rule carries an alt headline the engine uses when narrating.

Determinations run at full certainty. Every determination in every live run returned at certainty 100. The graph presents no probabilistic score, and no output converts a likelihood band into a number.

6. Calibration guide

Everything that varies by institution is a named parameter with a documented default. No such value is hard-coded inside a rule — the parameters are facts on a policy instance in the parameter part, read by the rules that need them. The static check for this was run mechanically over the whole graph.

Each parameter is labelled with where its default comes from: RULE (a fetched primary source states it) · PRACTICE (public practice sources only) · CONSERVATIVE (a documented choice where the sources are silent) · INPUT (no default; the institution or the board must supply it).

The parameters an institution must set before use

Parameter	Default	Label	Note
Framework overlay	unset	INPUT	Nothing concludes without it.
Materiality bands	supplied per bank	INPUT	The graph consumes the band, never the number. The SEC declined to set quantitative thresholds and no UK threshold exists, so the posture itself is sourced.
Key control designation	no default	INPUT	The bank's.
Material control designation	no default	INPUT	The board's. The FRC says prescribing this is not its role.
Boundary of "meriting management attention"	no default	INPUT	ISA (UK) 265 gives a test but no boundary, so no figure ships.

Sample size by frequency and risk — PRACTICE

Frequency	Low	Medium	High
Annual	1	1	1
Quarterly	2	2	2
Monthly	2	3	5
Weekly	5	10	15
Daily	20	25	30
Multiple times daily	25	40	60

Three independent public guides were found that publish this grid, and a fourth was found that publishes a dissenting table. All four are in the source register. The direction of the test is sourced (evidence increases as the risk associated with the control increases; sample size rises as the tolerable rate falls and the expected rate rises) — the figures are practice, and the output says so when it reports one.

Three companion parameters: automated controls take one instance where the general IT controls are effective and currently tested, otherwise the frequency size with a floor of 25; rounding is up, never down, because the figures are floors and not targets; and each performer, site or system is a separate population, each sampled.

The table's own stated basis in all three corroborating sources is that it assumes no expected deviations. A bank that expects deviations must raise the size rather than accept the cell.

Exceptions — the conservative defaults

Parameter	Default	Label
Single exception treatment	a deficiency pending evaluation; the sample is not extended to clear it	CONSERVATIVE
Sample extension switch	off	CONSERVATIVE
Exception of unknown nature	treated as systemic	CONSERVATIVE
Tolerable deviation rate	zero deviations below a sample of 25; one at 25 or more	PRACTICE
Expected deviation rate	zero	PRACTICE

The single-exception default is a deliberate conservative choice, and it is defensible from the sources: AS 2201 ¶48 makes a deviation trigger a reassessment of the risk, the evidence needed and the conclusion, and no source permits clearing a deviation by extending the sample. The sources contradict each other here — one practice guide publishes an escalation ladder (extend 25 → 40 → 60 → fail), another states "do not simply extend the sample" and calls dilution the error auditors challenge. Both readings are recorded; the conservative one ships. Extension remains available as a parameter for assessing the extent of a failure, and is recorded as such when used.

Because a deviation does not automatically mean failure, the graph carries Exception Requiring Evaluation as a rung distinct from Not Operating Effectively — AS 2201 ¶48 and its Note are the warrant.

Roll-forward — the weakest-sourced figures in the pack

Parameter	Default	Label
Maximum roll-forward gap	3 months to period end; beyond 6 months roll-forward is unavailable and a fresh test is required	PRACTICE, single quantitative source
Full-retest triggers	change of process, change of system, change of the person performing the control, any exception at interim, gap beyond the maximum	RULE for the change and exception legs; PRACTICE for the elapsed-time leg
Roll-forward sample size	proportional to the gap, floor of 1, 2–5 for a key control	PRACTICE

AS 2201 ¶56 makes the interim gap an uncapped judgement and ISA (UK) 330 ¶A34 lists six factors without quantifying any of them. Exactly one public source gives an explicit numeric trigger. This is flagged here because it is the figure most likely to need changing: three practice sources agree that the deciding factor is change, not elapsed time, and that change triggers a retest however short the gap.

Remediation — no authoritative source gives a number

Frequency of the remediated control	Sufficient period before period end
Daily or more often	3 months
Weekly	3 months
Monthly	6 months
Quarterly	2 quarters; where remediation lands in the final quarter, conclude in the following year
Annual	the next occurrence of the control

PRACTICE throughout. The SEC release declines to give a number; one Big Four public guide states expressly that a sufficient period and a sufficient number of instances are required and gives no figure; the three practice sources that do give figures disagree (a flat 3 months; 6 months for a monthly control; 3–12 months by frequency). The table above is the most conservative synthesis of the three.

Three companion parameters: the clock starts on the date the remediated control was first performed as designed, not the date the fix was implemented (a practice inference — no source found is explicit); the retest takes the frequency-appropriate sample size, not merely the first instance after the fix; and the retest is performed independently of the person who implemented the remediation.

Severity — the grid, and the single ambiguous cell

Magnitude ↓ / Likelihood →	Remote	Reasonably possible	Probable
Inconsequential	deficiency	deficiency	deficiency
More than inconsequential	deficiency	significant deficiency	significant or material
Material	significant deficiency	top severity	top severity

PRACTICE. Two independent public sources publish this grid cell for cell identically, which is why it ships as the default — but one of them calls it "a starting point for discussion, not an answer key", the SEC deliberately omitted a likelihood component from the significant-deficiency definition and declined quantitative thresholds, and a third source publishes a two-tier materiality-anchored variant instead. The output states that the mapping was applied and that it is a calibration parameter.

The more-than-inconsequential / probable cell is left genuinely open by both corroborating grids. Rather than silently pick a side, the graph resolves it by a dedicated parameter (default: significant deficiency, escalating where an indicator or the prudent-official test applies) and the output says the cell is ambiguous in the sources and which way the parameter resolved it.

The SAB 99 five per cent benchmark is deliberately not used and the omission is recorded: it is a materiality rule of thumb, not a deficiency-severity threshold, and loading it as a severity cut-off would be a category error.

Compensating controls

Default, per AS 2201 ¶68: a compensating control may reduce severity — including from the top US rung down to a significant deficiency — only if it is tested effective and precise enough, and addresses the same assertion. An untested one reduces nothing. The precision leg is sourced; the tested-effective leg is CONSERVATIVE, because ¶68 does not state it in terms. The whole effect is a parameter.

Four explicit clearances mean the output always says why no reduction happened: no control claimed; claimed but not qualifying; an indicator applies; the prudent-official test fails.

Indicators — two deliberately opposite defaults

Path	Default	Label
US	an indicator is conclusive — it alone establishes the top severity	CONSERVATIVE
UK / international	an indicator is not conclusive — it raises severity for determination and never establishes it	RULE

Both are defensible and they point in opposite directions, so they are two separate parameters and neither overlay can inherit the other's posture. On the US side, both 33-8810 II.B.1 and AS 2201 ¶69 say only "evaluate", and the conservative reading of that silence is that an indicator decides. On the international side, ISA (UK) 265 ¶¶8, A6 and A7 make the indicators expressly illustrative and require the practitioner still to determine significance — so the sourced default is the opposite.

Prior-period evidence — the one hard numeric cap in the standards

Maximum assessments since a control was last tested: 3. UK, RULE. ISA (UK) 330 ¶14(b) requires testing "at least once in every third audit" and ¶A38 repeats it as every third year. This is the only hard numeric cap any fetched primary source states, and unlike every other figure in this pack, an institution that lengthens it departs from the standard. Reliance is unavailable regardless of the count where the control changed relevantly or addresses a significant risk.

The US path does not use this route. Its analogue is PCAOB benchmarking, which states no interval at all, so the US baseline-age cap (36 months) is practice throughout.

The remaining parameters

Review control precision margin (the review threshold must sit below the materiality band — three independent practice sources say only "below", "well below" or "a fraction of" materiality, and no public source located states a numeric fraction, so the margin is expressed in bands and never in money); evidence hierarchy by risk (the floor — inquiry alone is never sufficient — is RULE, the risk tiering is practice); self-assessment admissibility (off, CONSERVATIVE, because the SEC permits it for management in low-risk areas and the PCAOB bars low-objectivity work for the auditor); objectivity separations; sampling method ranking (the standards require a representative selection but rank no method, so the graph reports the method rather than refusing one); aggregation grouping (same line item, assertion or COSO component — RULE); the entity-information depth taxonomy by report class; service-organisation report depth; the search-obligation floor (off: the determination does not require a search for deficiencies less severe than the top rung); the preventive/detective timing consistency check; the two cross-path practice offers (the UK interim change enquiry offered on the US path; the US report-class depth tests offered on the UK path), each labelled practice on the path it is not sourced on and never cited as authority there.

Extending to a third jurisdiction

The overlay machinery is parameterised rather than hard-wired, so adding an ISA 265-only, J-SOX or Canadian NI 52-109 overlay means: adding a Framework instance; adding that overlay's own determination concept with its own disjoint instance set; writing the overlay's rules with the framework gate as their leading condition; and giving the overlay its own finding, reason and summary relationships. The core method, the parameter layer and the gate layer are untouched. One asymmetry to know about: the scope decline is written only by the US gate, because the Provision 29 scope sentence reaches all four control categories and so the UK path declines nothing on scope. A new overlay that declines on scope needs its own relay with its own instrument citation — the graph records this in a comment at the relay.

7. Source register

The full register — publisher, title, version and effective date, URL, date accessed and the paragraphs relied on — is in Regulatory Cross Reference Documentation.md, reproduced in summary here. All sources were fetched on 14 October 2026. Every rule in the graph traces to a paragraph in a public primary source.

Tier 1 — primary (the only source of rules)

United States. SEC Release 33-8810 (72 FR 35324) · SEC Release 33-8829, Definition of the Term Significant Deficiency · 17 CFR 229.308 (Item 308) · 17 CFR 240.12b-2 · 17 CFR 210.1-02(a)(4) · 17 CFR 240.13a-15 · 15 U.S.C. 7262 and 7241 · 12 CFR Part 363 (as amended 90 FR 55811, effective 1 January 2026) · PCAOB AS 2201 · AS 2315 · AS 1105 · AS 1305 · AS 6115 (cited only as persuasive analogous guidance on remediation, never as a binding rule) · PCAOB Staff Audit Practice Alert 11.

United Kingdom. UK Corporate Governance Code 2024 · FRC Corporate Governance Code Guidance Section 4 (2024) · three FRC Provision 29 Mythbusters (January 2026, June 2026, September 2026) · FRC Code Feedback Statement (January 2024).

Auditing standards — the ISA 265 bridge. ISA (UK) 265 · ISA (UK) 330 · ISA (UK) 315, all Updated September 2025, plus the un-amended IAASB ISA 265 text used to corroborate the UK text and record the effective-date divergence.

Framework. COSO Internal Control — Integrated Framework executive summary only, plus the free COSO-published Internal Control FAQs. The framework itself is copyright and is not public: only the free publications were read, the principles are referenced by number and short name only, all substance is paraphrased, and no framework body text beyond the public executive summary is reproduced anywhere in this pack. The FAQ's deferral to external regulators' severity criteria is the primary-source warrant for the whole overlay architecture.

Tier 2 — practice (calibration defaults only, never rules)

Nineteen public practice sources: Center for Audit Quality; three sample-size guides plus a dissenting fourth; a roll-forward guide with the only explicit numeric trigger; two severity-grid publishers plus a dissenting third; four remediation-period sources that disagree with each other; three management review control guides; four entity-information guides; and a sampling-methods guide. Where practice sources disagree, both readings are recorded rather than the inconvenient one being dropped.

Tier 3 — context only (never a source of rules)

BCBS 40 and BCBS 328; EBA/GL/2021/05; FCA SYSC; the PRA Rulebook; and the superseded 2018 Code, recorded only as the transitional position.

Provenance

Nothing in this pack derives from any institution's own material. No client, prospect or NDA material; no proof-of-concept graph, test suite or control inventory received from any institution; no paywalled or licensed firm methodology; no internal audit manual; and no source reached by circumventing an access control. The pack's provenance is independent of all client work. No institution, system or product is named anywhere in the graph, the tests or this documentation.

What could not be retrieved — flag before any production use

Recorded honestly, because a gap filled from recollection would breach the source constraints.

Gap	Consequence
AS 2201 ¶¶B26–B33 (the benchmarking appendix) were recovered from a third-party mirror; pcaobus.org returns 403 to the fetcher.	The benchmarking rules rest on these paragraphs and must be verified against the PCAOB original before any production use.
The authoritative FRC PDFs could not be text-extracted (403). The Code text and the three disclosure elements were taken from FRC-hosted HTML conversions carrying an FRC accuracy disclaimer, corroborated across three or more separate FRC documents.	The exact Provision 29 sentence should be verified against the authoritative PDF before production use.
ISA (UK) 265, 315 and 330 were read through a public text-extraction proxy over the FRC's own URLs. Paragraph numbering, requirement text and A-paragraph headings are first-hand; the rendering is a conversion.	Paragraph citations should be confirmed against the authoritative PDFs.
ISA (UK) 315 ¶¶A166–A183 could not be extracted; every attempt truncated near ¶A95. The numbers and subject matter are first-hand from the requirement paragraphs' own cross-references.	No rule rests on that wording, and it must be confirmed before production use.
SEC Release 33-8810 Sections III.C–III.F were not retrieved (the govinfo text truncated mid-Section III).	Section III is the cost-benefit and regulatory-flexibility analysis. No requirement rests on it.
COSO's full framework and the ICFR Compendium are sold, not published.	Not consulted. COSO's own glossary definitions sit in the full publication and are paraphrased from a free COSO-published summary; they are not used as rule text.
The AICPA Audit Sampling guide is a paid publication.	Its tables are not legitimately reproducible and were not reproduced.
The amended AS 2201 ¶.09 / new ¶.99, and AS 2315 ¶.11	Watch items; the amendments touch no paragraph relied on, but the version is dated.

Where primary sources conflict

Six SEC-versus-PCAOB conflicts and six US-versus-ISA divergences are tabulated in the source register with the resolution for each. The rule applied in every case: the auditor standard is the conservative default, the choice is exposed as a parameter, and the conflict is documented. The US-versus-ISA divergences are not resolved by preferring one text: the two overlays are kept separate so each path takes its own source's posture.

Four internal inconsistencies inside the ISAs (UK) as published are recorded rather than silently smoothed (the ISA 265 effective-date divergence between the UK and IAASB texts; the ISA 330 A-paragraph cross-references that do not line up with the printed headings; ¶14(b)'s "every third audit" against ¶A38's "every third year"; and dual-purpose testing sitting in application material rather than a requirement paragraph). None is load-bearing for a rule.

Four citation corrections the sources required

Version checks were run on every instrument, and three citations in the original specification did not survive the check. None changes the method.

"Persuade a reasonable person" is not in AS 2201. ¶46 says "persuade the auditor", and "reasonable person" appears nowhere in the standard. The nearest analogue is the prudent-officials test at ¶70, which the graph encodes as a fifth US indicator.
The severity definitions sit at ¶A3, ¶A7 and ¶A11, not at the paragraphs cited. ¶A5 defines ICFR itself.
Release 33-8810 has no Section II.C. Its outline is I / II.A (II.A.1 a–e, II.A.2 a–c, II.A.3) / II.B (II.B.1–5) / III. Evidence evaluation is at II.A.2.
The FDICIA small-institution exemption is at 12 U.S.C. 1831m(j) with a $150,000,000 statutory floor; Part 363's own thresholds rose effective 1 January 2026 (applicability to $1bn; management ICFR assessment and auditor attestation to $5bn). These are context and appear in no rule, because scoping is out of scope.

8. Glossary and terminology mapping

The graph uses the standards' own terms and coins nothing. Where the two traditions use different words for the same idea, the graph holds both and renders the one belonging to the path in play.

Concept	US term	UK / international term	Term in the graph
The thing being judged	control	control	Control
A shortfall in a control	deficiency (AS 2201 ¶A3: design or operation)	deficiency (ISA (UK) 265 ¶6(a): designed, implemented or operated, or a necessary control missing)	Deficiency — the wider international limbs (implementation, missing control) are encoded in the core because they add coverage the US text does not contradict
Middle severity	significant deficiency (17 CFR 240.12b-2; AS 2201 ¶A11)	significant deficiency reportable to those charged with governance (ISA (UK) 265 ¶6(b))	separate values on separate relationships: Significant Deficiency (US) and Significant Deficiency Reportable To Those Charged With Governance (international)
Top severity	material weakness (17 CFR 240.12b-2; AS 2201 ¶A7)	no counterpart — the FRC expressly replaced the term in the 2024 Code	Material Weakness, a `US Severity` instance, reachable only on the US path
The UK reporting consequence	no counterpart	material control not operating effectively (Code 2024 Provision 29)	Material Control Did Not Operate Effectively, a `UK Declaration Outcome` instance, reachable only on the UK path
Who the finding goes to	those responsible for oversight of the company's external financial reporting / audit committee / board (AS 2201 ¶¶78–81)	those charged with governance (ISA (UK) 265 ¶9)	governance body in the core; each overlay renders its own term, and the ISA phrase never appears on a US output
Information the control uses that the entity produced	practice abbreviation "IPE"; AS 1105 ¶10 says "information produced by the company"; APA 11 says "system-generated data and reports"	same binding requirement	information produced by the entity. "IPE" appears in no primary source checked, so it is recorded here as the practice abbreviation only and no rule is cited to a practice source for the requirement itself
A review performed by a person over an output	management review control (APA 11)	—	management review control
General IT controls	ITGCs (AS 2201, APA 11)	general IT controls (ISA (UK) 315 ¶12(d))	general IT control, with the conclusion carrying the scope it covers
The band scale for exposure	inconsequential / more than inconsequential / material (¶A11 and legacy AS No. 2 vocabulary)	—	Materiality Band, supplied per bank as a band and never a number
The likelihood scale	remote / reasonably possible / probable (¶A7 Note, via the contingencies standard)	—	Likelihood. Taken only as a band: AS 2201 ¶65 Note 1 says the reasonable-possibility evaluation can be made without quantifying the probability as a percentage or a range, so no numeric probability is ever asked for or emitted
COSO's own severity word	—	—	"major deficiency" is not a determination value anywhere. COSO's FAQ defers to the external regulator's criteria where one exists, so the US overlay classifies with the SEC and PCAOB vocabulary and the UK overlay with the Code's
The judgement that a deficiency warrants attention	—	deficiency meriting management attention (¶10(b)) / meriting neither	Deficiency Meriting Management Attention / Deficiency Meriting Neither, with Classification Not Determinable where the judgement was not supplied

9. Requirement → rule coverage

The full map, with per-requirement rule counts and scope tags, is in Regulatory Cross Reference Documentation.md, produced mechanically from the graph itself. Headline:

Measure	Value
Rules in the graph	865
Requirement IDs defined in the register	259
Register IDs carried by at least one rule	218
Rule-name IDs with no register entry	0
RULE-kind requirements with no rule	3, all prohibitions enforced by a static check (A7, F8, C16e)

Every rule name carries its scope tag, the requirement IDs it implements and its source reference, so the map is produced from the graph itself rather than maintained alongside it. Requirement IDs appear at any position in a rule name, not only the first.

Requirements that correctly carry no rule

Parameters are facts on the policy instance, read by the rules that need them. The static check confirms each exists as data and that no rule hard-codes its value.
Definitions and inputs fix vocabulary or name a fact the bank supplies; they appear as concepts, relationship declarations and askable question text.
Output obligations are discharged by the narrative channel of the decision point they belong to, under that decision point's own requirement ID.
Prohibitions cannot be rules. "No UK output may use the top US severity term" and "no US output may cite Provision 29" are satisfied by the absence of offending text; a rule asserting a prohibition asserts nothing. They are enforced by the static checks, run mechanically over every part. The same applies to "no numeric roll-forward threshold is standard-derived", which is enforced by the parameter check.
The fact schema uses a dotted ID namespace that cannot appear in a rule name; it is verified instead by the relationship inventory in §4.

10. Static checks

All run mechanically over the graph, the test suite and this documentation, not by eye.

Check	Result
Every rule has a source reference and a scope tag	Pass. 865 of 865.
No rule contains a literal value listed as a parameter	Pass.
No institution, client, system or product name appears in the graph, tests or documentation	Pass.
The top US severity term appears only in US-tagged rules, US test expectations and the glossary	Pass. In this documentation the term is confined to §8.
The phrase describing a system as ready for production appears nowhere	Pass.
The source register lists every document cited by any rule, with URL and date accessed	Pass.
Provision 29 and FRC citations appear only in UK-tagged rules	Pass.
No single rule names both jurisdictions' instrument families	Pass.

On the ISA limb of the last check. ISA 265/315/330 are the bridge between the overlays, so a framework-neutral rule citing PCAOB text alongside ISA (UK) text is the intended bridge form, not a blend. The check is therefore enforced as: no US-tagged rule may impose an ISA requirement the US path does not carry. One US-tagged rule names ISA (UK) 330 ¶12(a), and it is compliant on that reading because its entire content is that the ISA formulation is offered as a labelled practice step and is not a requirement on the US path — its absence never fails a US determination.

11. Design decisions

Architecture: layered pipeline with a framework-parameterised overlay pair. Input layer → parameter layer → gate layer → three decision points → overlay layer → explanation layer.
Two entities, not one. A deficiency is its own record joined by a declared relationship, because aggregation needs a severity per group member and string-object facts dedupe on (subject, relationship, object) — a plural list of deficiencies on the control would collapse three sibling deficiencies into one fact and the aggregated escalation would never fire. Counting within a group uses number-object derived facts summed with a count-guarded aggregation, because number-object facts do not dedupe and the sum is therefore exact.
Every determination ladder is a two-layer precedence ladder: plural candidate rules, then a singular determination gated on there being no higher candidate. This makes outcomes mutually exclusive by construction rather than by rule ordering.
Effective rungs require explicit clearances, never the mere absence of findings. An "operating effective" conclusion is not "nothing went wrong"; it is every sufficiency test positively cleared.
A reduction suppresses the higher rung; it does not add a lower candidate. A ladder that takes the highest candidate cannot implement a reduction by adding a lower one — the lower candidate is simply outranked. The compensating-control reduction is therefore an explicit marker fact that the higher rung reads as a condition.
Suppressed candidates are still reported, so the output says what the severity would have been and why it was reduced.
An injected deficiency type that contradicts a derived conclusion produces an input conflict and no determination. DP3 can run standalone on an injected record, and DP1/DP2 also derive failures. The injected record is the canonical identity and a derived conclusion corroborates it rather than creating a second one. Where the two genuinely disagree the graph emits a conflict plus an open question and reaches no severity determination — it does not pick a side, because a contradiction is a data-quality problem for the bank to fix, not a judgement for the graph.
Narrative text never shares a relationship whose count gates a determination. This is the single most consequential structural rule in the graph.
is material control remains an input with no default, and the UK material-control rules read it directly. This is an open design decision rather than a settled one: an institution that wants the graph to infer materiality from the control's scope, assertion and band would need a derivation layer in front of it, and the FRC's position is that the designation is the board's. The cost of the current choice is that a UK session must inject the designation either way — including false, to get the no-consequence answer rather than a question.

12. Testing and verification

The Studio suite is Rainbird Studio Test Suite (Main and Adversarial).json: 91 tests, of which 10 are red-team regression tests. Every expectation was read off a live run — none was written from the rules or from reasoning about what the graph ought to say.

All 91 are pure Inject → Query → Expect Result, with no answer-the-question steps, because the data layer is non-askable and a full injection asks nothing. All pass at certainty 100.

Coverage

Design — effective on a clean manual control, on an IT-dependent control and on a high-risk daily control; deficient on risk coverage, on no procedure described, on no evidence produced, on no precision threshold, and on an all-unknown attribute record. Control type — an automated control performed by a person is corrected to IT-dependent manual; a manual control stays manual; a genuinely IT-dependent one is not reclassified. Sample size — twelve grid cells spanning every frequency and all three risk levels. Operating effectiveness — effective under both overlays on the full record; not effective on one exception in five (the conservative default, sample not extended); insufficient evidence where a sample of 5 faces a required 30, and again where the general IT controls are deficient — in neither case a control failure. Reliance — available, not available and not applicable on both the IT-control and the entity-information surfaces. US severity — the full nine-cell grid, plus the FDICIA Part 363 regime reaching the same ladder, plus a design deficiency reaching it. Communication — all five AS 2201 routes including the board detour and the already-communicated relief, plus the two ISA (UK) 265 routes. International classification — all three outcomes. UK declaration — effective; failed on financial-reporting, operational and compliance scopes (the wider UK scope); and no declaration consequence where the board did not designate the control material. Compensating controls — a tested, precise, same-assertion control reduces the top rung by one; untested, imprecise, different-assertion and explicitly-absent ones reduce nothing. Aggregation — three deficiencies on one assertion escalate, and all three siblings escalate, with none left behind. Overlay separation — verified in both directions. Plain-language summaries — the design, operating, declaration and severity summaries all return and all sit inside the 80-word cap.

Each US severity test names the AS 2201 paragraph its expectation rests on; each UK test names the Provision 29 or FRC guidance paragraph.

The ten red-team regression tests

Each asserts that the graph does not reach a favourable or an invented answer.

Deficiency with no magnitude band → no determination, not a lenient one.
Deficiency with no likelihood → no determination.
Contradictory magnitude bands injected → resolves to the more severe, never the laxer.
UK deficiency queried on the US severity surface → empty.
US control queried on the UK declaration surface → empty.
UK deficiency queried for a US severity after a UK classification was reached → still empty.
Design record with every attribute answered unknown → Design Deficient, never Design Effective.
Compensating control explicitly absent → the top severity stands.
Compensating control of inadequate precision → the top severity stands.
Daily high-risk control tested with 5 of a required 30 → Insufficient Evidence, neither effective nor a failure.

Unknown never produces an approval anywhere in the suite.

Six scenarios that return a question, and are documented rather than tested

Each was run live and behaved correctly, but each returns a question, so it cannot be a pure Inject → Query → Expect Result. That the graph asks is the correct behaviour: a missing fact is asked for in backward-chain order rather than concluded on a guess.

Scenario	What it asks	Verified behaviour
No framework supplied	`has framework`	asks rather than defaulting to an overlay — the whole point of the test
No performer role on a design record	`has performer role`	asks; answering unknown then yields Design Deficient
Automated control, no performer role	`has performer role`	asks even though an automated control could clear the attribute through the application
Neither ISA judgement supplied	the two judgement flags	asks rather than guessing a classification
Partial design record: one attribute unknown, two absent	`has procedure described`	asks for an absent attribute rather than concluding on the unknown one
Severity with no magnitude band, queried on the open-question surface	`has framework` on the deficiency	the open-question roll-up is a control-level surface, so querying it on a deficiency asks

13. Deployment guidance

At demonstration scale, one control and a handful of deficiencies, every query answers quickly and nothing below is visible. At institution scale the shape of the graph matters, and these are the four structures to plan around:

The group-projection fan-out in the aggregation layer is the only super-linear structure in the graph. The per-axis projections derive one fact per sibling member of the group, and each needs that sibling's magnitude band — which, for a derived band, pulls the sibling's whole effective-band ladder. Asking for one deficiency's aggregated band therefore forces band derivation for every other deficiency sharing its assertion, line item or component.
Those projections are forced once per aggregation row per axis.
The open-question roll-up grows linearly with deficiencies per control and is the slowest query; it relays every deficiency-level question with no cap and no paging.
The group-size counts in the aggregation narrative re-count the whole group per axis per deficiency.

Guidance: scope the aggregation axes per assessment, and query deficiency surfaces one deficiency at a time rather than expecting a whole-population sweep in a single session. This is deliberately not implemented as a graph change — both would alter what the aggregation sees, which is a change of logic.

14. Files in this pack

File	What it is
`graph.xml`	The validated graph: the entire RBLang, 865 rules, every rule carrying its scope tag, requirement IDs and source reference.
`Rainbird Studio Test Suite (Main and Adversarial).json`	The Studio test suite: 91 tests including 10 red-team regressions, every expectation read off a live run.
`Solution Documentation.md`	This document.
`Regulatory Cross Reference Documentation.md`	The requirements register, the source register with its watch items, retrieval gaps and conflict resolutions, and the requirement-to-rule coverage map.
`MIT Licence.md`	The scoped MIT licence.
The MCP connection guide	Generated on import into RAKE; serves the graph to Claude and other MCP clients.

← Back to the accelerator