Internal Control Testing and Deficiency Evaluation: Regulatory Cross-Reference

Every rule in the graph carries, in its own name, its scope tag (CORE, US or UK), the requirement IDs it implements and the source document and paragraph it rests on. This document holds the provenance in one place: the requirements register (259 entries, each with its scope, kind and regulatory anchor), the source register (every instrument relied on with its version, URL, date accessed and paragraphs, the watch items, what could not be retrieved, and how conflicts between sources were resolved), and the requirement-to-rule coverage map regenerated from the shipped graph. Sources were fetched on 14 October 2026. Rule names are verbatim from graph.xml (865 rules, each occurring exactly once).

Requirements register

Every requirement carries a scope tag (CORE / US / UK) and is traced to named rules in the coverage map later in this document. Source references come from the public primary sources in the source register; a requirement with no fetched primary source is a labelled calibration parameter (PRACTICE) rather than a rule.

Legend: Scope CORE = framework-neutral method, US = SOX/PCAOB overlay, UK = Code 2024 overlay. Kind RULE = derives a determination, DEF = definition encoded as vocabulary, PARAM = calibration parameter, INPUT = fact the bank supplies, OUT = output/explanation requirement, CHK = static check.

---

A. Framework selection and scope gating

ID	Scope	Kind	Requirement
A1	CORE	RULE	A framework overlay must be supplied before any determination is reached. Nothing concludes without it.
A2	CORE	PARAM	Framework overlay parameter: unset by default; values US ICFR and UK Material Controls.
A3	US	RULE	The US path applies only to controls over financial reporting (ICFR). A control whose scope is not financial reporting is declined as outside ICFR.
A4	UK	RULE	The UK path accepts a material control of any kind — financial, operational, reporting or compliance.
A5	UK	INPUT	Material control designation is an input made by the board, not derived by the graph.
A6	US	INPUT	Key control designation is an input made by the bank.
A6a	US	RULE	The US path serves both listed-issuer SOX 404 reporting and FDICIA 12 CFR Part 363 reporting, because the deficiency vocabulary and the preclusion on an effective conclusion are the same in both (Item 308(a)(3); 12 CFR 363.2(b)(3)(iii)). The reporting-regime distinction is an input, and the output cites the instrument that applies to that regime.
A6b	US	OUT	Scoping is out of scope, so the graph never decides whether an institution is caught by Part 363 or is an accelerated filer. The asset thresholds (applicability $1bn, ICFR assessment $5bn from 1 January 2026, CPI-W indexed under 12 CFR 314.1) are recorded in the source register as context and appear in no rule.
A7	CORE	RULE	US and UK vocabularies must never blend: no UK output may use the term material weakness; no US output may cite Provision 29.
A8	CORE	DEF	COSO 2013 supplies the component vocabulary the graph groups by, and nothing more. Its five components in order are control environment, risk assessment, control activities, information and communication, monitoring activities; its seventeen principles are referenced by number and short name only and never reproduced (the framework is copyright and only the public executive summary was read). The component and principle of a control are inputs the bank supplies.
A9	CORE	RULE	COSO defers to the regulator on severity, and so does this graph. Where a regulator or standard setter has established its own criteria for defining, evaluating and reporting deficiencies, management should use only those external criteria to classify severity, in place of the framework's own classifications (COSO FAQ, derived from the 2013 framework). COSO's own term "major deficiency" is therefore NOT a determination value anywhere in the graph: the US overlay classifies with the SEC and PCAOB vocabulary, the UK overlay with the Code's. This is the primary-source warrant for the whole overlay architecture.
A10	CORE	DEF	COSO's own effectiveness test is recorded for context and is not a determination the graph reaches: an effective system requires BOTH that each component and each relevant principle is present and functioning, AND that the five components operate together in an integrated manner. "Present" means existing in design and implementation; "functioning" means continuing to exist in operation. The graph judges one control at a time and so never concludes on a system of internal control.
A12	CORE	CHK	Citation hygiene, and the rule that makes a CORE rule legitimate. A rule is tagged CORE only where the same proposition is stated in a primary source on each path, and it then carries a citation per overlay, rendered by an overlay-specific citation rule — never one rule emitting both citations (C16a and F10g are the model). A proposition stated in only one family of instruments is tagged to that overlay, however sensible it would be elsewhere: the PCAOB benchmarking route (C19–C19c) is US, the ISA prior-period route (C19d–C19h) is UK, and neither is applied on the other path. Where a sub-decision is needed on both paths but is sourced on only one, the unsourced path applies it as a labelled calibration parameter and the documentation says so (see C22a).
A13	CORE	RULE	No numeric probability may be demanded or emitted for a likelihood judgement: the reasonable-possibility evaluation can be made without quantifying the probability as a specific percentage or range (AS 2201 ¶65 Note 1). The graph therefore takes likelihood only on the three-point band scale, never a percentage, and no output converts a band into a number. This is distinct from G4, which governs the engine's own certainty.
A11	CORE	OUT	Where a deficiency is reported, the output names the COSO component the control sits in, because severity judgements may differ by objective category and deficiencies must be aggregated across components, not only within one. The component itself is an input (A8).

B. Decision point 1 — control design assessment

ID	Scope	Kind	Requirement
B1	CORE	RULE	Assess whether the control, as described, addresses its stated risk and carries every attribute needed to operate.
B2	CORE	RULE	Required attributes: performer role; frequency; timing relative to the transaction; procedure described; evidence produced; precision or threshold stated. A missing attribute is named individually in the output.
B3	CORE	RULE	Design assessment values: design effective; design deficient. A design deficiency exists where a necessary control is missing, or an existing control is designed so that the control objective would not be met even if the control operated as designed (AS 2201 ¶A3; 33-8810 fn.29).
B3a	CORE	DEF	An operating deficiency exists where a properly designed control does not operate as designed, OR the person performing it lacks the necessary authority or competence (AS 2201 ¶A3). The authority/competence limb is a distinct ground of failure and gets its own rule, not a footnote.
B4	CORE	RULE	Confirm or correct the control type (manual, automated, IT-dependent manual) and nature (preventive, detective) against the described attributes.
B5	CORE	PARAM	A preventive control operates before the transaction; a detective control operates after. Timing inconsistent with the stated nature is a design finding. PRACTICE, not rule: no fetched primary source states this mapping; the terms are used throughout the standards without being defined by timing. It is universal practice vocabulary, so it ships as a labelled consistency check exposed as parameter I28, and the finding it raises is a classification correction (B4's confirm-or-correct output), never by itself a design deficiency.
B6	CORE	RULE	For a management review control, assess precision against the six named factors (APA 11 pp.20-21): (a) objective of the review — one designed to prevent or detect misstatement is more precise than one that merely identifies and explains differences; (b) level of aggregation — a review at a granular level is more precise than one over a company-wide total; (c) consistency of performance — routine and consistent beats sporadic; (d) correlation to the relevant assertion; (e) predictability of the expectations used; (f) criteria for investigation — a threshold at or near financial statement materiality has less precision and a greater risk of failing to prevent or detect misstatement.
B6a	CORE	RULE	The investigation-threshold leg is deficient where the review threshold is not below the materiality band by the required margin; the margin is parameter I7 and appears in no rule as a literal. Source: APA 11 p.21 states the direction of the test ("at or near materiality has less precision") but gives no figure, so the margin is PRACTICE.
B6b	CORE	RULE	Verifying that the reviewer signed off provides little or no evidence by itself of the control's effectiveness (APA 11 p.20); a test evidenced only by a sign-off is insufficient evidence.
B6c	CORE	RULE	For a complex or less predictable account, a budget or forecast comparison review may not be sufficiently precise on its own and a combination of controls may be needed (APA 11 p.25).
B7	CORE	RULE	Design assessment of a management review control evaluates six items (APA 11 pp.21-22): whether it addresses the assessed assertion-level risk; the precision factors; the steps to identify, investigate and resolve significant differences; the performer's competence and authority; the frequency; and the information used, including whether it is system-generated. A missing item is named individually in the output.
B7a	CORE	RULE	Operating effectiveness of a management review control requires evidence of BOTH the steps the reviewer performed to identify and investigate significant differences AND the conclusions reached, including whether potential misstatements were investigated and corrective action taken (APA 11 p.23). Absent either, operating effectiveness is not established.
B8	CORE	RULE	A control marked automated but performed by a person, with no application relied on, is an internal inconsistency — flag it and reach no determination. Source basis: the warrant is not a prohibition on naming a performer but the standard's own rationale for treating automated controls differently — benchmarking is available to an entirely automated application control precisely because such controls are "not subject to breakdown through human failure" (AS 2201 ¶B28), and an IT-dependent manual control is a distinct type with distinct testing (¶¶39-41). A record asserting both an automated type and a human-performed, non-application control therefore cannot be true of one control under the standard's own taxonomy, which is why it is a data-quality conflict and not a determination.
B9	CORE	RULE	Design assessment requires no test evidence, so it runs on control facts alone (the demo front door). This is sound in the sources: design effectiveness is tested by determining whether the control, if operated as prescribed by a person with the necessary authority and competence, satisfies the control objective and can prevent or detect material misstatement (AS 2201 ¶42), and a walkthrough of inquiry, observation and inspection is ordinarily sufficient — re-performance is NOT required for design (¶43).
B9a	CORE	RULE	Operating effectiveness, by contrast, requires a mix that includes re-performance among its procedures (AS 2201 ¶45). The graph therefore holds two distinct evidence tests and never lets a design walkthrough satisfy an operating conclusion.
B9b	CORE	RULE	A control need not operate without any deviation to be effective; an identified deviation drives a reassessment of the risk associated with the control, the evidence needed and the conclusion (AS 2201 ¶48 and Note). This is the primary-source warrant for "exception requiring evaluation" being a distinct outcome from "not effective".
B9c	CORE	RULE	Less evidence is needed to conclude a control is NOT effective than to conclude it is effective (AS 2201 ¶47 Note). An adverse conclusion is therefore never gated on the full evidence-sufficiency set.
B10	CORE	OUT	The design output names each missing or inadequate attribute by name, the confirmed or corrected type and nature, and for a review control whether precision is adequate.

C. Decision point 2 — operating effectiveness adjudication

ID	Scope	Kind	Requirement
C1	CORE	RULE	Operating effectiveness values: effective; exception requiring evaluation; not effective; insufficient evidence. Operating effectiveness means the control operates as designed AND the person performing it has the necessary authority and competence to perform it effectively (33-8810 II.A.2; AS 2201 ¶A3).
C1a	CORE	RULE	A control whose performer lacks attested authority or competence is not operating effectively even where the sample shows no exceptions, because competence is part of the definition of operating effectiveness, not a separate quality test (33-8810 II.A.2; AS 2201 ¶A3).
C1b	CORE	RULE	Inquiry alone is never sufficient evidence of operating effectiveness; the evidence hierarchy runs inquiry, observation, inspection of documentation, re-performance (AS 2201 ¶50 and Note). A test whose only procedure is inquiry is insufficient evidence. Parameter I17 records that the SEC's management guidance is more permissive.
C1c	CORE	RULE	Evidence should ordinarily cover a reasonable period of time that includes the period end (33-8810 II.A.2.b); a test covering no part of the period up to period end cannot support a period-end conclusion without roll-forward work (C15/C16).
C2	CORE	RULE	Determine the required sample size from the control frequency and the risk associated with the control. The direction of the test is rule: evidence increases as the risk associated with the control increases (AS 2201 ¶46); the more extensively a control is tested the greater the evidence (¶54); and sample size rises as the tolerable deviation rate falls, as the expected deviation rate rises, and as the allowable risk of assessing control risk too low falls (AS 2315 ¶38).
C3	CORE	PARAM	Sample size table by frequency and risk — PRACTICE, and emphatically not rule. Confirmed by research: AS 2201 contains no sample-size table, no numeric minimum and no frequency-to-sample-size mapping anywhere in the standard; the only numeric anchors in PCAOB literature are AS 2315's tolerable rates (5 per cent or possibly less for a low assessed control risk; 10 per cent or more where assurance comes from other tests, ¶34), its 5-to-10 per cent allowable risk of assessing control risk too low (¶37 fn.9), and one express illustration of 60 items with zero deviations against a 5 per cent tolerable rate (¶41). The shipped table is therefore firm methodology, labelled practice, corroborated against two public practice sources, and consumed as a parameter. Corroboration (three public sources give the figures identically): Governance Docs, SOX Control Testing: The Clear Guide to Sample Sizes; SOXLayer, How many samples? A practical guide to SOX sample sizes by control frequency; Chiaro, How many samples does a SOC 2 auditor test? — all three give annual 1, quarterly 2, monthly 2-5, weekly 5-15, daily 20-40, multiple times daily 25-60, and all three expressly label the table professional convention and not a standard.
C3e	CORE	PARAM	Risk tiering of the sample-size table: the table ships as low/medium/high cells rather than ranges, because the ranges alone are not machine-decidable. Default grid (PRACTICE): annual 1/1/1; quarterly 2/2/2; monthly 2/3/5; weekly 5/10/15; daily 20/25/30; multiple times daily 25/40/60. Risk direction is corroborated by all three table sources ("lower risk toward the low end, higher risk toward the high end"). Recorded disagreements, per §5's duty to record both: one source sets a flat floor of 25 for daily with 40 at elevated risk and caps multiple-times-daily at 25; another gives daily 15-25 and multiple-times-daily 25-40; another collapses daily and weekly into a single 25-60 band; one source's own FAQ contradicts its table at up to 90. The low end of daily (15 vs 20 vs 25) and the high end (25 vs 30 vs 40) are both contested, and the institution is told so in the calibration guide.
C3f	CORE	PARAM	Automated control sample size: one instance, plus effective and currently tested ITGCs (five practice sources agree). Where the ITGCs are ineffective the fallback is the manual frequency-based size with a floor of 25 (one practice source). This parameter is the practice companion to the benchmarking rule at C19.
C3g	CORE	RULE	A control performed by several people, sites or systems is several populations, each sampled separately; and population completeness must be established before a sample is drawn. Citation note: AS 2315 ¶32 is about when sampling does not apply, so the warrant is ¶31(d) — the characteristics of the population are a factor in determining the sample — read with ¶17's requirement that the sample be expected to be representative of the population. The multi-population split itself is PRACTICE (parameter I20): no primary source prescribes it.
C3h	CORE	PARAM	Sample-size rounding: round up, never down; the table figures are floors and not targets (PRACTICE, one source, direction uncontested).
C3a	CORE	RULE	Where the control has no documentary evidence of performance, or depends primarily on segregation of duties, a sampling approach does not apply at all and no sample-size comparison is made (AS 2315 ¶32).
C3b	CORE	RULE	A selected item to which the planned or an alternative procedure cannot be applied is ordinarily counted as a deviation (AS 2315 ¶40). Untestable items are never silently dropped from the sample.
C3c	CORE	RULE	Where a combination of two or more controls is necessary to achieve one control objective, they are treated as a single control procedure and a deviation from any one of them counts as a deviation (AS 2315 ¶36).
C3d	CORE	RULE	A deviation is not a misstatement: deviations increase the risk of misstatement but do not necessarily produce one, and ordinarily produce misstatements at a lower rate (AS 2315 ¶35). The graph therefore never converts an exception count into a misstatement conclusion.
C4	CORE	RULE	A sample smaller than the required size is insufficient evidence, and the required size is stated in the output.
C5	CORE	RULE	Frequency must be known before an operating effectiveness conclusion is reached; the engine asks for it. Warrant: the extent of testing depends on the frequency with which the control operates (AS 2201 ¶54 — "the more frequently a control operates, the more operations of the control the auditor should test"), so with frequency unknown no required extent exists and no sufficiency conclusion can be formed. Frequency is also an explicit design attribute (¶42; B2), which is why it is asked rather than defaulted.
C6	CORE	RULE	Zero exceptions in a sufficient sample with sufficient evidence is effective.
C7	CORE	RULE	One exception is a deficiency pending evaluation; the sample is not extended to clear it.
C8	CORE	PARAM	Single-exception treatment parameter: conservative default (no extension). The extension-permitted alternative is exposed and switched off.
C9	CORE	RULE	An exception whose nature is unknown is treated as systemic, and the output states that the default was applied. Warrant: the qualitative aspects of a deviation — its nature and cause — must be considered (AS 2315 ¶42), so an unknown cause cannot be resolved in the control's favour. The conservative direction is parameter I5.
C10	CORE	RULE	Systemic exceptions, or a sample deviation rate above the tolerable rate, make the control not effective. No fetched source contains a tolerable count: AS 2315 ¶34 states tolerable rates. The comparison is on the rate throughout, and the only count in the graph is the exception count the bank supplies, from which the rate is computed.
C10a	CORE	RULE	The deviation rate in the sample is the best estimate of the deviation rate in the population (AS 2315 ¶41), so the tolerable-rate comparison is made on the rate, not on a raw exception count, and the output states both.
C11	CORE	RULE	A deviation that is a documentation gap is distinguished from a deviation that is a control failure; both are evaluated, not ignored. Source: the qualitative aspects of a deviation, including its nature and cause, must be considered, and a deviation is not itself a misstatement (AS 2315 ¶¶35, 42); ISA (UK) 330 ¶17(a) requires specific inquiries to understand the deviation and its potential consequences. The distinction is therefore sourced; what it does to the conclusion is not stated by either text, so the graph evaluates both classes and never discards a documentation gap, while the severity consequence of the gap class flows through the ordinary likelihood and magnitude judgement inputs rather than through a rule that silently downgrades it.
C12	CORE	SPLIT	Evidence sufficiency tests, each assessed and reported individually. The five legs are not of one provenance. Sourced legs (RULE): evidence retained (C13); procedures above inquiry only (C1b, AS 2201 ¶50); evidence shows what was done, which is the documentation-of-methods-and-basis obligation (33-8810 II.A.1.e and II.A.2.c; APA 11 p.20's holding that a sign-off alone evidences little); performer independent of the preparer, on the objectivity direction (33-8810 II.A.2 fn.40 and II.A.2.b). Practice legs (PARAM I29): evidence shows the performer and evidence dated within the period — the management guidance requires documentation of methods, procedures and the basis for conclusions but does not explicitly require recording the tester's identity or the date of testing. Both legs ship on by default, each reported as a labelled practice test, and an institution may switch either off without touching a rule.
C13	CORE	RULE	Evidence not retained is insufficient evidence regardless of sample results. Warrant: management must maintain evidential matter, including documentation, providing reasonable support for the assessment (33-8810 II.A.1.e, II.A.2.c); with no retained evidence there is no support, so no conclusion is available either way.
C14	CORE	RULE	Sampling method must be appropriate, and full-population testing needs no sample-size comparison. Source: sampling applies to a defined population and the sample must be expected to be representative, so that the auditor may reasonably draw a conclusion about the population (AS 2315 ¶¶17, 23, 39); where every item is examined no sampling risk arises and no sample-size test applies. The particular ranking of random over systematic over haphazard over judgemental is PRACTICE (parameter I30): no fetched source bars a haphazard or judgemental selection outright, so an inappropriate-method result is a reported sufficiency finding that the institution's parameter decides the weight of, never an automatic adverse determination.
C15	CORE	RULE	Roll-forward obligation: where operating effectiveness evidence was obtained at an interim date, the further evidence needed for the remaining period must be determined (AS 2201 ¶55). The four factors are the control and its risk, nature and interim results; the sufficiency of the interim evidence; the length of the remaining period; and whether there were significant changes in internal control after the interim date (¶56).
C15a	CORE	RULE	Inquiry alone suffices as a roll-forward procedure ONLY where ALL FOUR hold: the control is low risk; substantially all the evidence was obtained at interim with no exceptions; the roll-forward period is short (within the maximum gap parameter); and there were no significant changes in internal control after the interim date (AS 2201 ¶56 Note; APA 11 pp.28-29).
C15b	CORE	RULE	Inquiry alone is insufficient — a limited or full retest is required — where the control is complex, subjective or higher risk, OR interim testing was limited, OR exceptions were noted at interim, OR the roll-forward period is long, OR there were significant changes (APA 11 pp.28-29).
C16	CORE	RULE	Where the control changed after the interim test, or the gap exceeds the maximum gap, a full retest is required.
C16a	CORE	RULE	Roll-forward sufficiency may never be inferred from the absence of misstatements found by substantive procedures (AS 2201 ¶B9); a control must be tested directly. Independently warranted on the international path: the absence of misstatements detected by substantive procedures "does not provide audit evidence that controls related to the assertion being tested are effective" (ISA (UK) 330 ¶16). Two primary sources, two frameworks, the same rule — so it sits in the core with both citations.
C16b	UK	RULE	UK-tagged, not CORE: the two-limb formulation is ISA text and the US text states only the determination limb, so the change-enquiry limb is required on the UK path and offered as a labelled practice recommendation on the US path (parameter I31), never imposed there as a rule. The interim obligation has two cumulative limbs, and the graph requires both: evidence about significant changes to the controls after the interim period, AND a determination of the additional evidence needed for the remaining period (ISA (UK) 330 ¶12(a)-(b)). This is the international mirror of AS 2201 ¶55 and closes a gap in the US text, which states the determination limb but not the change-enquiry limb as a separate requirement.
C16c	UK	RULE	The factors determining the additional evidence for the remaining period are the significance of the assessed risks; which controls were tested at interim and what has changed since, including changes in the information system, processes and personnel; how much evidence was obtained at interim; the length of the remaining period; the extent of intended reliance; and the control environment (ISA (UK) 330 ¶A34). The personnel-change factor is explicit here where AS 2201 ¶56 leaves it implicit, and it is why a change of performer is a full-retest trigger (I8a).
C16d	UK	RULE	Additional roll-forward evidence may be obtained by extending the tests over the remaining period or by testing the entity's own monitoring process (ISA (UK) 330 ¶A35) — so the graph's limited-retest procedure value covers either, and the output does not prescribe which.
C16e	UK	RULE	Neither ¶12 nor ¶A34 quantifies the length of remaining period that triggers more work, and neither defines a significant change. Any numeric gap threshold is therefore firm methodology and not standard-derived — which is the second independent confirmation that I8 must be a labelled parameter rather than a rule.
C19d	UK	RULE	UK-tagged, not CORE: this is an ISA obligation and binds no SEC registrant. Prior-period evidence has a hard cap distinct from benchmarking. Where a control is unchanged and does not address a significant risk, evidence from a previous period may be used, but the control must be tested at least once in every third assessment, and some controls must be tested in every assessment so that reliance never rests on a single period's testing followed by two untested ones (ISA (UK) 330 ¶14(b), ¶A38). The graph therefore holds a maximum periods-since-last-test parameter and a rule that reliance is unavailable once it is exceeded. The interval below the cap is a judgement; the cap itself is rule.
C19e	UK	RULE	Prior-period evidence is never available in two cases: the control has changed in a way that affects the continuing relevance of the earlier evidence, and the control addresses a risk determined to be significant — the latter must be tested in the current period (ISA (UK) 330 ¶¶14(a), 15). The significant-risk prohibition is absolute and is not subject to the three-period cap.
C19f	UK	RULE	Continuing relevance of prior-period evidence must be established by inquiry combined with observation or inspection — inquiry alone will not do, consistent with C1b (ISA (UK) 330 ¶14).
C19g	UK	RULE	The factors that shorten the retest interval or defeat reliance on prior-period evidence altogether are a deficient control environment; a deficiency in the entity's monitoring process; a significant manual element in the control; personnel changes significantly affecting how the control is applied; changing circumstances indicating the control itself needs to change; and deficient general IT controls (ISA (UK) 330 ¶A39). The last of these corroborates C20 from the international side.
C19h	UK	DEF	A change that lets the entity receive a new report from a system probably does not affect the relevance of prior evidence, whereas a change that causes data to be accumulated or calculated differently does (ISA (UK) 330 ¶A37). This is the only worked distinction any fetched source gives for what counts as a relevant change, and it is recorded in the calibration guide to help an institution set the changed/unchanged input honestly.
C10b	UK	RULE	On detecting deviations the required response is three cumulative obligations: make specific inquiries to understand the deviations and their potential consequences; determine whether the tests performed still provide an appropriate basis for reliance, whether additional tests are needed, or whether the risk must instead be addressed by other procedures (ISA (UK) 330 ¶17(a)-(c)). This is the international warrant for the conservative single-exception posture: the standard requires understanding and a determination, and nowhere permits extending a sample to dilute a deviation away (see I21).
C10c	UK	RULE	Effective operation of a control admits some deviations, which may arise from changes in key personnel, seasonal volume fluctuations or human error; it is the detected deviation rate compared with the expected rate that may show the control cannot be relied on (ISA (UK) 330 ¶A42). This corroborates C10a's rate-based comparison from a second primary source and supplies the causes the graph offers as exception-nature context.
C17	CORE	PARAM	Maximum roll-forward gap parameter, default set from public practice and labelled practice. AS 2201 ¶56 gives no figure — only "the length of the remaining period" as a factor — so any number here is practice, not rule.
C18	CORE	RULE	An interim test date after the period end is invalid input and is rejected. This is a data-quality conflict rather than a sourced rule: "interim" means a date before the period end by definition in the roll-forward paragraphs (AS 2201 ¶¶55-56 speak of "the remaining period" after the interim date; ISA (UK) 330 ¶12 of "the remaining period"), so a later date describes nothing the standards contemplate. Handled like R4 — flag the conflict, reach no determination, never pick a reading.
C19	US	RULE	US-tagged, not CORE: benchmarking is a PCAOB route with no ISA counterpart, so it is applied only on the US path and the UK path uses the prior-period route (C19d–C19h) instead. Note on provenance: ¶¶B28-B33 were recovered from a third-party mirror and not from the PCAOB original, which refuses automated retrieval. The four conditions are therefore shipped behind the benchmarking-permitted switch (I9/C21) with the verification caveat recorded in the source register and the documentation, and the pack states that these paragraphs must be checked against the PCAOB original before any production use. ¶60 — the initial-year limb — was fetched from the standard's own displayed text and is not subject to the caveat. ITGC reliance / benchmarking ("test of one") for an entirely automated application control requires ALL FOUR conditions (AS 2201 ¶60, ¶B28, ¶B29): (a) it is not an initial-year assessment — benchmarking is available only in subsequent years (¶60); (b) the general controls over program changes, access to programs and computer operations are effective; (c) those general controls continue to be tested in the current period; (d) the control is verified unchanged since the baseline was established. Failure of any one defeats benchmarking.
C19a	US	RULE	Benchmarking applies only to an ENTIRELY automated application control, the rationale being that such controls are not subject to breakdown through human failure (AS 2201 ¶B28). An IT-dependent manual control is never eligible.
C19b	US	RULE	Where the automated control depends on a related file, table, data or parameter (the standard's example is a rate table used by an automated interest calculation), benchmarking the program logic alone is insufficient and the integrity of that data must also be addressed (AS 2201 ¶B30).
C19c	US	RULE	A baseline must be re-established after a period of time whose length depends on the circumstances (AS 2201 ¶B33). Where the elapsed baseline age exceeds the maximum baseline age parameter, benchmarking is not available and the control must be tested afresh.
C20	CORE	RULE	Where the ITGCs are deficient or not tested, a test of one is not permitted and the result is insufficient evidence pending manual testing.
C20a	US	RULE	A deficient ITGC does not itself misstate, but it impairs every IT-dependent control relying on it, so its severity is assessed across all affected controls and accounts in the aggregate, not control by control (APA 11 pp.27-28).
C21	CORE	PARAM	Benchmarking permission parameter and maximum baseline age parameter. The four conditions are rule (AS 2201 ¶B29); the maximum baseline age has no numeric answer in the standard (¶B33 makes it circumstance-dependent) so the figure is PRACTICE.
C22	CORE	RULE	IPE reliance: where the control relies on information produced by the entity and its completeness and accuracy are untested, the result is insufficient evidence. Warrant: information produced by the company and used as evidence requires procedures to test its accuracy and completeness, or the controls over them including ITGCs and automated application controls, AND an evaluation that it is sufficiently precise and detailed (AS 1105 ¶10); the same obligation extends to any internally produced information used in an important control (APA 11 fn.45).
C22a	CORE	PARAM	The IPE/ITGC depth tests are sourced asymmetrically, so tagging them all CORE would put PCAOB-only text into UK explanations. The obligation to establish the reliability of internally produced information is dual-sourced and stays CORE with a citation per overlay: AS 1105 ¶10 on the US path, and on the UK path ISA (UK) 315 ¶12(d), ¶12(g) and ¶26(b) (general IT controls and the risks arising from the use of IT) with ISA (UK) 330 ¶A39's final factor (deficient general IT controls defeat reliance). The depth tests drawn from APA 11 — report classes, query logic, parameters, two-way testing (C23, C23a, C23b, I23) — are US, because APA 11 binds no UK engagement; on the UK path they are offered as a labelled practice recommendation under parameter I32 and the output says they are practice there, not rule.
C23	US	RULE	IPE reliance also requires that the logic of the queries or parameters used to extract the data be tested; an unchecked report parameter or untested query logic is an IPE finding (APA 11 pp.26-27, which records this as an inspection-identified failure requiring remedy).
C23a	US	RULE	Where an IT-dependent control is selected for testing, BOTH the control itself AND the IT controls over the completeness and accuracy of the data or reports it uses must be tested (APA 11 p.27; AS 2201 ¶¶39-41, ¶47). Testing the control alone is insufficient evidence.
C23b	US	RULE	Customised data or queries falling outside the ITGCs actually tested are not covered by that ITGC conclusion (APA 11 p.27); the graph records the scope of the ITGC conclusion and does not extend it by implication.
C24	US	RULE	A system-generated report relied on by the control inherits the ITGC conclusion for its system, and where the ITGCs over the generating application are ineffective, other procedures over the report writer or system are required (APA 11 pp.26-27).
C24a	CORE	DEF	Terminology note: the practice abbreviation "IPE" appears in no primary source checked — APA 11 says "system-generated data and reports" and the binding requirement is AS 1105 ¶10's "information produced by the company". The graph's term is "information produced by the entity", the glossary records IPE as the practice abbreviation, and no rule is cited to APA 11 for the requirement itself.
C26	US	RULE	Entity-level control reliance, within the scope boundary. Entity-level control evaluation is out of scope, so the graph never judges an entity-level control. But ¶23's third tier is a reliance rule that changes the extent required of the control in front of it: where an entity-level control is designed to operate at a level of precision that would adequately prevent or detect misstatements to the relevant assertion, and it sufficiently addresses the assessed risk, no additional controls relating to that risk need be tested (AS 2201 ¶23(iii)); a tier-(ii) monitoring control may reduce the testing of other controls; a tier-(i) indirect control is never sufficient alone (¶¶22-23). The graph therefore takes the tier of any entity-level control relied on as an input — the bank's own conclusion, reached outside this graph — and applies the reliance consequence, stating plainly that it has evaluated the relied-on control's effect and not the control itself.
C27	US	PARAM	Service organisations. Where part of a process is outsourced, the evidence available to management is the service organisation's own report; the SEC's worked example of an aspect that cannot be assessed is a significant outsourced process where no Type 2 service-auditor report will be provided and there are no compensating controls (33-8810 II.B.5), and AS 2201 ¶¶B17-B27 govern reliance on a service-auditor report. The graph takes three inputs — the control depends on a service organisation; a service-auditor report covering the relevant controls is available; the report's period covers the assessment period — and treats the absence of such a report with no compensating control as the E15 unassessable-aspect path rather than as an effective conclusion. This is the single commonest real scope question a bank asks and it would otherwise fall through to "effective". The depth of service-auditor-report evaluation is parameter I33 and the graph never second-guesses the report.
C28	US	PARAM	The search boundary. The assessor is not required to search for deficiencies less severe than a material weakness (AS 2201 ¶62), and the management guidance states no equivalent. The graph never infers from an incomplete deficiency population that none exists, and whether the institution's own methodology obliges a search below material weakness is parameter I34 (default: no obligation, the standard's own position), reported in the output so a bank reading a short deficiency list knows why it is short.
C29	US	RULE	Superseded controls. Where a control was superseded during the period by a new control achieving the same objectives, and the new control has been in place long enough to assess its design and test its operating effectiveness, the superseded control need not be tested for the ICFR conclusion; but it must still be tested where it is important to the control-risk assessment for the financial statement audit (AS 2201 ¶53). The graph takes control superseded in period, successor achieves the same objectives and successor in place long enough to test as inputs, and returns "superseded control need not be tested" as a distinct DP2 outcome — not "effective" and not "insufficient evidence". Without it a replaced control falls through to insufficient evidence, which is wrong under the standard.
C30	US	PARAM	Year-to-year unpredictability. The nature, timing and extent of testing should be varied from year to year to introduce unpredictability — a different interim period, more or fewer tests, a changed combination of procedures — and across locations in a multi-location engagement (AS 2201 ¶61, ¶B13). This is a programme-level obligation and not a judgement about one control, so the graph never fails a control for it: it is a recorded output statement, on by default under a switch, naming the prior-year test approach as an input and saying when the current approach repeats it.
C31	CORE	RULE	Dual-purpose samples. A sample may be designed for two purposes — testing the operating effectiveness of a control and testing whether the recorded transaction is correct (AS 2315 ¶44; AS 2301 ¶47 fn.20 citing it); on the international path the same point sits at ISA (UK) 330 ¶A23 as commentary. The graph accepts a dual-purpose test as valid evidence of operating effectiveness and never discounts it for having served a substantive purpose too; the sample size required remains the larger of the two purposes' sizes, which is an input because the substantive size is computed outside this graph.
C32	US	RULE	Reliability of information. Two further legs sit alongside C22: (a) where the institution supplies, in electronic form, information it obtained from an external source, reliability requires an understanding of that source and of the institution's process for receiving, maintaining and processing it including any modification before delivery, and either a test of whether the information was modified or a test of the related controls including ITGCs (AS 1105 ¶10A); (b) the reliability hierarchy — independent knowledgeable sources over internal ones, controlled electronic information over uncontrolled, directly obtained over indirect, originals over copies and conversions, with any third-party restriction or disclaimer evaluated (AS 1105 ¶08). The graph takes the evidence's source class and form as inputs and applies the hierarchy as a reliability finding on the DP2 output; it never silently upgrades a photocopy or an unverified external feed to the same standing as directly obtained original evidence.
C33	US	DEF	Whose determination is being made: the two-assessor problem. AS 2201 is written for the auditor and 33-8810 for management, and the two have different evidence entitlements (I17, I18 record the divergence). The graph makes one determination at a time and takes the assessor role as an input (management or second line; internal audit; external auditor), stating it in every output. Where the role is the external auditor the output adds that other relevant evidence must be taken into account, including misstatements the control failed to detect and the reports internal audit issued during the year on ICFR-related controls (AS 2201 ¶71 and its Note). The graph never blends the two entitlements in one determination, and never presents a management determination as an audit conclusion (see F10a for the UK counterpart).
C25	CORE	OUT	The operating effectiveness output states: the required sample size for the frequency and risk; whether evidence met each sufficiency test; whether the roll-forward is sufficient and which further procedures apply (inquiry, limited retest, full retest); and whether ITGC and IPE reliance was available.

D. Decision point 3 — deficiency evaluation (core)

ID	Scope	Kind	Requirement
D1	CORE	RULE	A design failure or an operating failure gives rise to a deficiency to be evaluated for severity.
D2	CORE	INPUT	Likelihood of misstatement (remote, reasonably possible, probable) is a management judgement supplied as an input; the output names the judgement and the role that should own it.
D3	CORE	INPUT	Magnitude is supplied as a materiality band, never a number.
D3a	US	RULE	The magnitude asymmetry. The maximum amount by which a balance or transaction total can be overstated is generally the recorded amount, while understatements could be larger (AS 2201 ¶67). The graph therefore takes the direction of exposure (overstatement, understatement, or both) as an input alongside the magnitude band, and where the exposure includes understatement no rule may cap the magnitude band at the recorded-amount ceiling. Without this, a bank could cap an understatement exposure and under-state severity — which is precisely the error the paragraph exists to prevent. The same paragraph records that the probability of a small misstatement is generally greater than that of a large one; that is a judgement aid recorded in the calibration guide and not a rule, since it quantifies nothing.
D3b	CORE	RULE	A deficiency surfaced by substantive work is still a deficiency. Where an audit adjustment or a misstatement detected by substantive procedures indicates a control did not prevent or detect it, that is a deficiency for evaluation (AS 2201 ¶B8 and APA 11 pp.32-33 on the US path; ISA (UK) 330 ¶A41 and ISA (UK) 265 ¶A7 on the UK path, both already recorded at F10h). This is the positive counterpart of C16a, which only says the absence of misstatements proves nothing: the presence of one is affirmative evidence the other way. Detected-misstatement and management-bias indications are inputs, never derived.
D4	CORE	RULE	Compensating control adequacy: a compensating control reduces severity only where it exists, has been tested effective, and its precision is adequate for the magnitude concerned. Source wording: a compensating control accomplishes the objective of another control that did not function properly (33-8810 fn.49), and to have a mitigating effect it must operate at a level of precision that would prevent or detect a misstatement that could be material (33-8810 II.B.1; AS 2201 ¶68). The "tested effective" leg is the conservative reading of ¶68's "should evaluate the effect of compensating controls" and is exposed as parameter I13.
D5	CORE	RULE	An untested compensating control reduces nothing. Warrant: practice guidance states the compensating control must itself be tested and must address the same relevant assertion as the control that failed (APA 11 pp.34-35); the "same assertion" leg is a CORE rule and the "must be tested" leg is parameter I13.
D6	CORE	PARAM	Compensating control effect parameter, default as AS 2201: may reduce severity including from the highest severity to the next, only if tested effective and precise enough.
D7	CORE	RULE	Aggregation: deficiencies on the same line item, assertion or COSO component are evaluated in combination, and the combination may carry a higher severity than any individual deficiency. Source wording: multiple deficiencies affecting the same financial statement amount or disclosure increase the likelihood of misstatement and may in combination constitute a material weakness though individually less severe; management should group by common amount, common disclosure or common component of internal control (33-8810 II.B.1; AS 2201 ¶65 Note 2).
D7a	CORE	RULE	The interaction among deficiencies, and the interaction of a control with other controls including whether they are interdependent or redundant, are named likelihood factors and so bear on severity directly, not only through grouping (33-8810 II.B.1; AS 2201 ¶65).
D8	CORE	PARAM	Aggregation grouping parameter: same line item, assertion or COSO component. The component grouping leg has its own warrant: deficiencies must be aggregated across components and not evaluated only in isolation within one, because the components operate together only where the aggregated deficiencies do not amount to a severe shortfall (COSO FAQ on the 2013 framework).
D8a	CORE	RULE	No compensating-component argument is admissible: the presence and functioning of other components does not mitigate a severe shortfall in one (COSO 2013 executive summary, effective internal control). The graph therefore never lets a healthy component elsewhere reduce a severity, and only a compensating control meeting D4's conditions may do so.
D9	CORE	RULE	Remediation: a deficiency remediated before period end, where the remediated control was retested over a sufficient period, does not persist at period end. Source note: AS 2201 has no remediation paragraph. The warrant is assembled from the as-of-date nature of the assessment (AS 2201 ¶B2; 17 CFR 229.308(a)(2)) plus the requirement that evidence cover a period sufficient to assess operating effectiveness (AS 2201 ¶¶52-53) and ordinarily include period end (33-8810 II.A.2.b). AS 6115 is voluntary guidance on reporting on whether a material weakness continues to exist and is cited as persuasive analogous guidance, never as a binding AS 2201 rule. APA 11 carries no remediation guidance and is not cited for it.
D10	CORE	RULE	A remediated control retested over too short a period leaves the original severity standing at period end.
D11	CORE	PARAM	Sufficient period of operation for a remediated control: minimum occurrences or months before period end, by frequency; default from public practice, labelled practice. No primary source gives a number, so this parameter carries no rule tag at all: it is practice throughout, and the output names it as a calibration input.
D12	CORE	RULE	Whether a retest is required is stated, with the conditions for it. Remediation planning beyond that is out of scope.
D13	CORE	RULE	Communication to the governance body is determined for every finding, citing the applicable instrument. The determination has three parts — whether to communicate, to whom, and by when — and the graph states all three on both paths. The core holds the three-part shape; each overlay supplies its own recipients, channel, deadline and citation (E10 for the US, F10/F10e for the UK), because the two instrument families say different things and A12 forbids one rule carrying both citations.
D13c	US	RULE	A deficiency below significant is NOT communication-free on the US path: all deficiencies of a lesser magnitude than a material weakness must be communicated in writing to management, and the audit committee must be informed that the communication was made (AS 2201 ¶81). The graph therefore carries a third US communication outcome, not two. ¶81 adds one relief: a deficiency already covered by a written communication from the auditor, internal audit or others in the organisation need not be repeated — encoded as an input (already communicated in writing) that switches the outcome to no further communication required, never to no communication owed.
D13d	US	RULE	The communication output never asserts completeness: the procedures are not required to identify every deficiency, only those the assessor is aware of (AS 2201 ¶82), and no report may state that no deficiencies were noted (¶83; AS 1305 ¶08). D13a is the prohibition; this row is its companion — the output says what was found and what is owed, and nothing about what was not found.
D14	US	RULE	Found by live testing. The two facts the US communication routes turn on — whether the finding was already communicated in writing (H7.12) and whether audit committee oversight is itself ineffective (AS 2201 ¶79) — are properties of a deficiency, which this graph derives. Neither can therefore be asked of anyone, and reading them as raw injected flags left a material weakness with no communication duty at all whenever a caller did not inject them: silence where ¶78 requires a written communication to management and the audit committee before the report is issued. Each is read through a derived position carrying a conservative default — the ¶81 relief does not apply unless stated (an unevidenced claim would discharge a duty the facts do not show discharged, J4), and oversight is not treated as ineffective unless stated (assuming a failure would invent the fourth ¶69 indicator against a committee the caller said nothing about, while assuming none keeps the wider ¶78 addressee list). Both defaults are calibration parameters.
D13a	CORE	RULE	No negative assurance may be expressed about the absence of further deficiencies (AS 2201 ¶¶82-83), so the communication output states only what was found and never that nothing else exists.
D13b	CORE	DEF	The core vocabulary term is "governance body". The US overlay renders it with the PCAOB's own term — "those responsible for oversight of the company's external financial reporting" / audit committee / board — and never the ISA phrase "those charged with governance", which belongs to the UK/international overlay only.

E. Decision point 3 — US overlay

ID	Scope	Kind	Requirement
E1	US	RULE	US severity values: deficiency; significant deficiency; material weakness. The three definitions sit at AS 2201 ¶A3 (deficiency, with its design and operation limbs), ¶A7 (material weakness) and ¶A11 (significant deficiency), and are mirrored for financial-statement-only audits at AS 1305 ¶01/¶03/¶02. (¶A5 defines ICFR itself and is not a severity definition.)
E1a	US	DEF	"Reasonable possibility" in the material weakness definition is defined by AS 2201 ¶A7 Note by reference to the accounting standard on contingencies: the likelihood of the event is either reasonably possible or probable as those terms are used there. The graph therefore takes the likelihood band as an input on that three-point scale (remote / reasonably possible / probable) and the "at least reasonably possible" test is the union of the upper two bands.
E2	US	RULE	Inconsequential magnitude with remote likelihood is a deficiency.
E3	US	RULE	More than inconsequential but less than material magnitude with reasonably possible likelihood is a significant deficiency. Source note: the operative definition (17 CFR 240.12b-2; 17 CFR 210.1-02(a)(4); AS 2201 ¶A11) is purely comparative — "less severe than a material weakness, yet important enough to merit attention by those responsible for oversight" — and the SEC deliberately omitted any likelihood component and declined to add quantitative thresholds (Release 33-8829). The magnitude/likelihood mapping that yields U2 is therefore NOT in the primary sources: it is calibration parameter I12, labelled practice, and the rule reads the parameter rather than a literal.
E3a	US	DEF	The band label "inconsequential" comes from the superseded AS No. 2 definition and does not appear in the current definitions. It survives here only as a materiality-band label supplied by the institution (I6), never as a threshold inside a rule. Documented in the glossary as legacy vocabulary.
E4	US	RULE	Material magnitude with at least reasonably possible likelihood, with no qualifying compensating control, is a material weakness.
E5	US	PARAM	Significant deficiency threshold: the mapping of magnitude band and likelihood to the merits-attention-of-governance test.
E6	US	RULE	A qualifying compensating control reduces a material weakness to a significant deficiency, and the reasoning names the compensating control relied on.
E6a	US	RULE	Added during the final coverage pass, to define IDs the rules already carried. The explicit-false clearance for E6: where no compensating control is claimed against the deficiency, no reduction in severity arises and the graph records that fact rather than leaving the reduction silently absent (AS 2201 ¶68). A reduction must be earned; silence never reduces.
E6b	US	RULE	The clearance for a claimed compensating control that does not qualify — untested, imprecise, or addressing a different assertion — which reduces nothing (AS 2201 ¶68; 33-8810 fn.49).
E6c	US	RULE	No compensating-control reduction is available where an indicator of material weakness applies: the indicator route is not answerable by a compensating control (AS 2201 ¶¶68 and 69).
E6d	US	RULE	No compensating-control reduction is available where the deficiency fails the prudent-official test (AS 2201 ¶¶68 and 70).
E11a	US	RULE	Added during the final coverage pass. The entity-level input discipline supporting E11: an entity-level finding above the control level is taken only as supplied by the institution and is never asserted by the graph in its absence, and the severity of each deficiency on each covered control is evaluated before the ICFR conclusion is read (Reg S-K Item 308(a)(3); AS 2201 ¶¶63 and 64). A covered control carrying no deficiency is recorded as such, so an empty set is distinguishable from an unevaluated one.
E7	US	RULE	Indicators of material weakness each independently establish a material weakness, on the indicator alone: fraud by senior management; restatement to correct a material misstatement; a material misstatement identified by the auditor and not by ICFR; ineffective oversight by the audit committee. Source note: both 33-8810 II.B.1 and AS 2201 ¶69 call these "indicators" that must be "evaluated", and neither text says whether an indicator is conclusive or rebuttable. Encoded as conclusive — the conservative reading — and exposed as parameter I16 so an institution may make it rebuttable. The conflict is documented, not hidden.
E7i	US	DEF	Indicator definitions come from the paragraph's own footnotes and are inputs, not derivations: "senior management" for the fraud indicator is defined by reference to the officers who certify under SOX §302 (AS 2201 ¶69 fn.14), and "restatement" means a restatement to correct a material misstatement as that term is used in the applicable accounting standard on accounting changes and error corrections (¶69 fn.15). The graph asks whether the fraud was by a §302 certifying officer and whether a restatement corrected a material misstatement, and does not attempt to classify seniority or materiality itself.
E7a	US	RULE	The prudent-official standard is a fifth indicator: where a deficiency might prevent prudent officials from concluding there is reasonable assurance that transactions are recorded as necessary to permit GAAP preparation, that is an indicator of a material weakness (AS 2201 ¶70; 33-8810 II.B.1).
E7b	US	RULE	Severity does not depend on whether a misstatement actually occurred (33-8810 II.B.1; AS 2201 ¶64).
E8	US	RULE	Aggregated deficiencies whose combined magnitude is material and whose likelihood is at least reasonably possible are an aggregated material weakness.
E9	US	OUT	The US output states the likelihood and magnitude judgements relied on, whether a compensating control reduced severity and why, whether any indicator applied, the aggregation result, and whether a retest is required.
E10	US	RULE	Material weaknesses and significant deficiencies must be communicated to the audit committee, and the output states the channel and the deadline separately for each: a material weakness in writing to management and the audit committee before the ICFR report is issued (AS 2201 ¶78); a significant deficiency in writing to the audit committee, timely (¶80). Where the audit committee's oversight is itself ineffective, the communication goes to the board (¶79).
E11	US	RULE	A material weakness existing at period end means ICFR cannot be concluded effective, and it must be disclosed. The preclusion is explicit in the text of Reg S-K Item 308(a)(3) (17 CFR 229.308(a)(3)) and, for an insured depository institution, in identical terms at 12 CFR 363.2(b)(3)(iii) — so one rule carries both citations and the US path serves listed issuers and FDICIA-only banks alike.
E12	US	RULE	No qualified or "except for" ICFR conclusion is available: management may not say ICFR is effective except for an identified material weakness, though it may state ICFR is ineffective for specific reasons (33-8810 II.B.2).
E13	US	RULE	Severity determines the disclosure channel, and the two channels are distinct: a material weakness is publicly disclosed in the annual ICFR report AND communicated privately; a significant deficiency is communicated privately to the auditor and audit committee but is NOT publicly disclosed (Item 308(a)(3); 33-8810 II.B.3 and fn.52; SOX §302(a)(5); Item 601(b)(31)(i) ¶5). A deficiency below significant requires neither.
E14	US	OUT	Where a material weakness is disclosed, the output states that disclosure should convey the nature of the weakness, its impact on financial reporting and ICFR, and the remediation planned or undertaken, and should distinguish pervasive from non-pervasive (33-8810 II.B.3). "Pervasive" is undefined in every primary source checked, so pervasiveness is an input, never derived.
E15	US	RULE	An inability to assess part of ICFR is not a permitted scope limitation: management must decide whether the inability is significant enough to compel an ineffective conclusion (33-8810 II.B.5).
E16	US	RULE	Restatement precedence. A restatement correcting a material misstatement is an indicator of a material weakness for the current period's determination (E7), and at the same time it "does not, by itself" require the prior year's ICFR conclusion to be reconsidered, with no requirement to reassess or revise the previously filed conclusion (33-8810 II.B.4). The two are not in conflict and the graph holds them apart: the restatement indicator applies only to the period under assessment, and no rule reaches back to a prior-period determination. Where a restatement is present the output adds that the prior disclosures should be considered for continued appropriateness and supplemented if misleading, and that a material change to ICFR is itself disclosable under Item 308(c) — both stated as board or management actions, never as determinations the graph makes.
E17	US	RULE	FDICIA reporting scope. For a Part 363 determination "financial reporting" includes, at a minimum, both the GAAP-basis financial statements and the financial statements prepared for regulatory reporting purposes, with recognition and measurement conforming to GAAP and to FDI Act §37 (12 CFR 363.1(c); App. A Guideline 4A identifies the Call Report schedules equivalent to basic financial statements, and excludes a non-bank subsidiary's own regulatory filings). So a control over a regulatory return is inside ICFR on a Part 363 determination though it would be outside ICFR for a listed-issuer-only determination — which is exactly the regulatory-return reconciliation control in the example library. The reporting regime (A6a) therefore gates A3's financial-reporting scope test, and the output names which scope it applied.
E18	US	RULE	Acquired-business carve-out. An acquired business's internal control may be excluded from the assessment where assessment is not feasible before the report due date, provided the report identifies the acquired business, states the exclusion and indicates its significance; material control changes arising from the acquisition must still be disclosed; the exclusion is available for one annual assessment only; and an acquired institution that remains subject to Part 363 must continue to file its own report (12 CFR Part 363 App. A Guideline 8B). Encoded as a scope outcome — "control excluded as acquired-business scope, disclosure obligations stated" — with acquired in period, assessment feasible before the due date and prior-year exclusion already taken as inputs. Second year running, the exclusion is unavailable and the control must be assessed.

F. Decision point 3 — UK overlay

ID	Scope	Kind	Requirement
F1	UK	RULE	UK determination values: material control operated effectively; material control did not operate effectively at the balance sheet date. The Code's own vocabulary, confirmed by a full-text check: "material controls", controls that "have not operated effectively", and a "declaration of effectiveness" (Code 2024, Provision 29).
F1a	UK	DEF	The declaration is as at the balance sheet date — a point in time, not a period (Provision 29 second bullet; FRC Guidance ¶296). The review behind it is period-based, running the full year up to and including that date (¶281). The graph holds these apart and never conflates them: a period-based review can find an in-period failure while the point-in-time declaration stays clean.
F1b	UK	DEF	The declaration is a reasonable conclusion from the work carried out and the evidence obtained, not a guarantee or absolute certainty (FRC Guidance ¶296), and an effective control does not eliminate the underlying risk (¶286). The output says so, and never presents the declaration as assurance against future failure.
F1c	UK	RULE	Effectiveness for the declaration includes design and implementation, not operation alone (FRC Guidance ¶297, third limb). A material control that operated without exception but is defectively designed therefore fails the balance-sheet-date test — so the UK path consumes the DP1 design determination and does not rest on test results alone.
F2	UK	RULE	A failed material control not remediated at the balance sheet date did not operate effectively and must be disclosed. Warrant: the trigger is a material control "not operating effectively at the date of the balance sheet" (FRC Guidance ¶297, first limb; Provision 29 third bullet). An issue persisting at that date is expressly one the FRC expects to see reported (Provision 29 Mythbuster, 29 January 2026).
F3	UK	RULE	The declaration's three disclosure elements are stated: (a) a description of the material controls that have not operated effectively as at the balance sheet date; (b) the action taken, or proposed, to improve them; (c) any action taken to address previously reported issues (Code 2024, Provision 29 third bullet; mirrored at FRC Guidance ¶290 third item and ¶297). The "or proposed" wording matters: a disclosed failure with remediation only planned still satisfies the element, so the graph never requires completed remediation for the disclosure to be adequate.
F4	UK	RULE	A material control that failed in-period but was remediated and retested before the balance sheet date operated effectively at that date and need not be described under Provision 29's third bullet. The FRC states there is no "expectation that companies report on a material control failure if it has been rectified by the balance sheet date" (Provision 29 Mythbuster: Preparing to report, FRC, 29 January 2026), and ¶297's trigger is conditional on ineffectiveness at that date. Independently corroborated: a deficiency in the same broad area "does not necessarily contradict the Board concluding that material controls are effective" (Provision 29 Mythbuster on auditor responsibilities, FRC, 24 June 2026).
F4a	UK	RULE	Carve-back to F4 — publicised in-year issues. Where a remediated in-period failure was publicised during the year, the FRC expects reporting against it even though the declaration itself is clean at the balance sheet date, because shareholders and stakeholders are already aware of it (same 29 January 2026 Mythbuster). Encoded as a separate reportable statement attached to a clean declaration, never as a qualification of the declaration. Whether such reporting belongs inside the Provision 29 section or elsewhere in the annual report is not resolved by any FRC source, so the output says the reporting is expected without asserting where it sits. Public disclosure of the in-period failure is an input.
F4b	UK	RULE	Internal escalation survives remediation even where no external disclosure is triggered: any significant issue should be reported to the board "even if it has been remediated", with the actions taken (FRC Guidance ¶262), and the annual review must consider the incidence of significant control failings and the actions taken on material controls that did not operate effectively (¶284 items 13-14). So a remediated in-period failure always produces a communication outcome, and sometimes no disclosure outcome.
F4c	UK	RULE	Post-balance-sheet-date procedures may be relevant to the declaration (FRC Guidance ¶300, which also confirms the declaration covers information collected before and on that date). Whether such a procedure can cure a control ineffective at the balance sheet date, or only evidence that it was effective then, is not stated anywhere. The graph takes the narrow reading — later work evidences the balance-sheet-date state and cannot cure it — because that is what "as at the balance sheet date" requires, and the output names the choice.
F4d	UK	RULE	A later discovery does not void a declaration already made: effectiveness is stated as at the balance sheet date and there is no duty to revise it for matters discovered afterwards (29 January 2026 Mythbuster).
F3a	UK	OUT	Provision 29's first disclosure bullet. The annual report must also carry "a description of how the board has monitored and reviewed the effectiveness of the framework" (Code 2024, Provision 29 first bullet; mirrored at FRC Guidance ¶290). The graph judges one control and so cannot write that description, but every UK output names it as a required disclosure the board must supply, so a bank reading the output does not mistake the declaration for the whole of Provision 29. The second bullet is the declaration itself (F1) and the third is the three-element disclosure (F3).
F3b	UK	DEF	The boundary that stops the UK output overclaiming. The declaration relates to the internal controls and not the framework as a whole (FRC Guidance, executive summary ¶8), whereas the annual effectiveness review behind it is of the framework. Every UK determination is therefore expressed about the control before it and never about the bank's framework, and the output says so in terms. With F1b (a reasonable conclusion, not a guarantee) this is what keeps a single-control answer from reading as a framework opinion.
F5	UK	RULE	A non-material control failure has no declaration impact; the deficiency is recorded and the communication test still applies.
F5a	UK	INPUT	Material control designation is the board's and nobody else's: the FRC states it is "not the FRC's role or intention to prescribe or dictate what a material control is for a company" (FRC Guidance, executive summary ¶8), material controls are company-specific by size, business model, strategy, operations, structure and complexity (¶270), and the test the board applies is how a hypothetical deficiency in the control could impact the interests of the company, shareholders and other stakeholders (¶271). The graph therefore consumes the designation and never derives it. Illustrative categories the board may consider (¶272) are documented in the calibration guide, not encoded as a rule.
F5b	UK	DEF	No quantified materiality threshold for controls exists anywhere in the Code or the guidance (full-text check). The UK path consumes bands and designations only, never a number — the same posture as the US path for a different reason.
F6	UK	RULE	An operational, non-financial material control is evaluated on the UK path. Warrant: the monitoring and review "should cover all material controls, including financial, operational, reporting and compliance controls" (Provision 29, scope sentence) — four categories, where the 2018 Code had three, "reporting" being the 2024 addition. The UK path is therefore wider than ICFR by the Code's own text, which is why A3/A4 split the two paths on control scope.
F6a	UK	DEF	The guidance describes controls as spanning five aspects — strategic, reporting, financial, operational and compliance (¶248) — one more than Provision 29's four. Whether a strategic control falls inside the declaration is resolved by neither text. The graph accepts the Provision 29 four as in scope and treats "strategic" as a fifth accepted value that the output flags as an open question in the sources rather than silently including or excluding.
F7	UK	RULE	A control reported as ineffective in the prior year's declaration and now effective requires disclosure of the action taken on that previously reported issue. This element is triggered by what was previously reported, not by whether the control is currently ineffective (Provision 29 third bullet; FRC Guidance ¶297 fourth limb, which separately mandates "a summary of how the board has addressed previously reported issues"). How many prior years are in scope, and whether "previously reported" means reported under Provision 29 or anywhere, is undefined in both texts, so the lookback is an input and the output says the scope is a board judgement.
F8	UK	RULE	The UK output never uses the term material weakness. This is not merely a house style: the term appears nowhere in the Code 2024, consultation respondents expressly asked the FRC to avoid US SOX terminology, and the Feedback Statement ¶54 records that "reporting of all material weaknesses" was replaced by reference to material controls that have not operated effectively. Using it in a UK output would import vocabulary the FRC deliberately removed.
F9	UK	OUT	The UK output states whether the declaration must disclose the failure, the three disclosure elements, and whether a retest is required.
F9a	UK	RULE	Where the board cannot determine a material control's effectiveness, or cannot give a declaration, it may rely on the Code's comply-or-explain nature and explain the position in the annual report (FRC Guidance ¶298). The guidance is permissive ("could") and names no alternative, so this is a distinct UK outcome — "effectiveness not determinable, explain under comply or explain" — and never a silent failure or an assumed clean declaration. It is the UK counterpart to the US rule that an inability to assess is not a permitted scope limitation (E15), and the two differ: the US compels a conclusion, the UK permits an explained departure.
F9b	UK	RULE	No disclosure of an improvement area or remedial action is expected where, in the board's professional judgement, it would reveal confidential information or something that could inadvertently affect the company's interests if publicly reported (FRC Guidance ¶299). The graph therefore reports that disclosure is required while recording that the board may withhold commercially sensitive detail — and the pack's examples never descend to a level of technical detail the FRC says should not be published.
F10	UK	RULE	Communication to the governance body is determined citing the international audit standard, independently of the declaration outcome. Warrant now fetched: a significant deficiency in internal control must be communicated in writing to those charged with governance on a timely basis (ISA (UK) 265 ¶9); deficiencies of sufficient importance to merit management's attention are communicated to management at an appropriate level, also timely (¶10); and the written communication must contain a description of the deficiency with an explanation of its potential effects, plus sufficient information for the recipients to understand its context (¶11). The three parts the graph states are therefore the same as the US three — whether, to whom, by when — but the citation and the recipient term differ.
F10c	UK	DEF	The ISA 265 bridge. ISA (UK) 265 ¶A12-1 is the explicit link between the audit standard and the Code: in the UK, prompt written communication of significant deficiencies to the directors of a listed entity "can assist them to comply with the provisions of the UK Corporate Governance Code" on internal control and reporting to shareholders. This is the only place in the fetched primary sources where the audit standard and the Code are joined, and it is what makes the core method legitimately shared between the two overlays.
F10d	UK	DEF	ISA (UK) 265 ¶6(a) defines a deficiency in internal control on four triggers — a control designed, implemented or operated such that it cannot prevent, or detect and correct, misstatements on a timely basis (¶6(a)(i)), or a necessary control missing (¶6(a)(ii)). The implementation limb is wider than the US definition's design/operation pair (AS 2201 ¶A3) and is the international warrant for F1c's reading that effectiveness includes design and implementation, not operation alone. ¶6(b) defines a significant deficiency as a deficiency or combination of deficiencies that in professional judgement merits the attention of those charged with governance.
F10e	UK	RULE	The UK/international path carries a three-way classification, not the US ladder: a significant deficiency (¶6(b), communicated in writing to those charged with governance), another deficiency of sufficient importance to merit management's attention (¶10(b), communicated to management only), and a deficiency meriting neither. ISA 265 defines no boundary between the second and third classes — "other deficiency" is left undefined and the only test given is the likelihood and potential magnitude of misstatement (¶A22) — so the boundary is a documented judgement input and the graph asserts no threshold.
F10f	UK	RULE	Indicators are NOT conclusive on the international path. ISA (UK) 265 ¶A6 lists eight matters bearing on significance and ¶A7 seven indicators of a significant deficiency, both expressly illustrative ("may consider", "include, for example"), and ¶8 requires the auditor's own determination. The international path therefore treats an indicator as raising severity for consideration and never as establishing it, which is the opposite default from the US parameter I16 — a deliberate, sourced divergence, not an inconsistency. The one near-exception is a previously communicated significant deficiency left unremediated without explanation, which ¶A17 says "may in itself represent a significant deficiency" — still permissive, so still not conclusive.
F10g	UK	RULE	Significance does not depend on a misstatement having occurred: it turns on the likelihood that a misstatement could occur and its potential magnitude, and a significant deficiency may exist even though no misstatement was identified (ISA (UK) 265 ¶A5). This mirrors the US rule at E7b and is the same proposition in both overlays, so it sits in the core with a citation per overlay.
F10h	UK	RULE	A material misstatement found by the auditor and not prevented or detected by internal control is a strong indicator of a significant deficiency (ISA (UK) 330 ¶A41; ISA (UK) 265 ¶A7 item 5). It is the international counterpart of the US indicator at E7, and it is an input, not something the graph derives.
F10i	UK	RULE	There is no nil-report obligation: ISA (UK) 265 ¶9 is triggered only by an identified significant deficiency, and ¶3 permits but does not require other communication. The graph therefore never asserts a communication requirement merely because an assessment was completed, and never states that nothing further exists — the same posture as the US no-negative-assurance rule at D13a, reached from a different text.
F10a	UK	DEF	The Provision 29 declaration is other information for audit purposes, not an audited statement: auditing standards were not changed or extended in response to the Code, the auditor reads and considers the statement for material inconsistency under ISA (UK) 720 (Revised November 2019), and performing those procedures "does not represent an assurance engagement" (24 June 2026 Mythbuster). The board's material controls and the controls relevant to the audit overlap but "are not identical and serve different purposes". The graph's UK output is a management/board determination and the documentation says plainly that it is not an audit opinion.
F10b	UK	DEF	No external assurance over material control effectiveness is required or expected by the Code or the guidance; whether to obtain it is a board decision (FRC Guidance ¶¶274-276). The graph therefore never treats the absence of external assurance as a deficiency.
F11	UK	RULE	Near misses are reportable to the board: instances where a control only narrowly delivers the intended outcome, particularly repeatedly within a reporting period, should be reported, and while not clear deficiencies they suggest the framework is not operating as intended (FRC Guidance ¶289). The graph carries a distinct UK finding for a near miss, which produces a communication outcome and no declaration consequence.
F12	UK	RULE	Where an improvement area emerges the board should establish how it arose, its impact, and how effective the remedial measures were, and re-evaluate its monitoring processes (FRC Guidance ¶287). This is the Code regime's root-cause requirement and is why root cause is an input on the UK path as well as the US one.
F13	UK	OUT	Three UK severity-adjacent terms are board-defined and not aligned by any source: "significant control failing" (which ¶250 requires the board to define), "material control not operating effectively" (the Code's disclosure trigger), "improvement area" (¶288) and "near miss" (¶289). The relationship between them is not addressed anywhere, so each is an input value with its own consequence and the graph asserts no ordering between them.
F14	UK	OUT	Provision 29 applies to accounting periods beginning on or after 1 January 2026, with first reporting expected from 2027; until then the 2018 Code's Provision 29 applies (Code 2024, Application section and Provision 29 footnote 9). The UK output names the instrument version it applied, and the documentation records that the 2018 Code is cited only as the superseded transitional position and is not a source of any rule.

G. Outputs and explanation

ID	Scope	Kind	Requirement
G1	CORE	OUT	Every query returns a determination, the rule chain that produced it with source references, and the facts relied on, or the facts still needed.
G2	CORE	OUT	Each rule's evidence surfaces its source document and paragraph at query time.
G3	CORE	OUT	Negative findings are explained as fully as positive ones: the output says why a deficiency is not the highest severity, not only why one is.
G4	CORE	OUT	Determinations run at full certainty; no probabilistic score is presented.
G5	CORE	OUT	Where a framework leaves a judgement to management, the output names the judgement taken as an input and the role that should own it.
G6	CORE	OUT	A missing fact is asked for, in the order the backward chain needs it; the output lists open questions rather than concluding on a guess.
G7	CORE	OUT	Each output carries a plain-language summary for a control owner of no more than 80 words, followed by the formal chain.
G8	CORE	OUT	Each output names the framework and the instrument versions applied.
G9	CORE	OUT	Results are identical through Studio, the MCP endpoint and the demo workbench.
G10	CORE	OUT	The communication determination is an output in its own right, not a line inside the severity output, because it is reached on both paths and from different instruments: whether to communicate, to whom, by when, in what form, and the paragraph relied on (D13, D13c, D13d, E10, F10, F10i). It is stated even where the determination is that nothing is owed, and the statement always says which instrument made it so.
G11	UK	OUT	The UK output carries the not-determinable outcome as a first-class result (F9a), not as a failure or an absent answer: effectiveness not determinable, with the comply-or-explain route named and the facts that were missing listed. A UK query must never return silence where the board cannot conclude.
G12	UK	OUT	Where a remediated in-period failure was publicised during the year, the output carries the expected reporting as a separate statement attached to a clean declaration (F4a), visibly distinct from a Provision 29 disclosure trigger, and says that where that reporting sits in the annual report is not resolved by the FRC sources.
G13	UK	OUT	A near miss produces its own finding and its own communication outcome with no declaration consequence (F11), and the output says the control is not thereby deficient while recording that repetition within a reporting period is what makes it reportable.
G14	CORE	OUT	Every deficiency output names the COSO component the control sits in and the aggregation group it was evaluated in (A11, D7, D8), so a reader can see both why a severity was reached alone and what it was combined with. The component is an input and is never derived.

H. Fact schema (inputs only — no fact encodes a conclusion)

Each row has an ID, an askability posture (ASK = a control owner or tester answers it; INJ = systems-of-record or board/bank data, injected, askable="none"), and the requirement that consumes it. The implementing relationship names are declared in the graph.

Three properties hold for every row, and were re-checked row by row: the bank can supply it from its own records; it encodes no conclusion the graph should reach; it names no system, person or product.

H1. Context and identity

ID	Fact	Posture	Consumed by
H1.1	Framework overlay	ASK (first question)	A1, A2, X2
H1.2	Reporting regime (SOX listed issuer / FDICIA Part 363 / UK Provision 29)	INJ	A6a
H1.3	Control scope (financial reporting, operational, reporting, compliance, strategic)	ASK	A3, A4, F6, F6a
H1.4	Period end date; assessment date	INJ	C1c, F1a, D9
H1.5	Risk addressed; assertion; line item; COSO component	ASK (risk) / INJ (rest)	A8, A11, D7
H1.6	Key control designation	INJ	A6
H1.7	Material control designation	INJ	A5, F5a
H1.8	Materiality band set and the band at issue	INJ	I6, D3
H1.9	Risk level of the control (low / medium / high)	ASK	C2, I2 — added: the sample-size grid had no risk input
H1.10	Instrument versions applied	INJ	G8 — added: G8 had no fact
H1.11	Assessor role (management or second line / internal audit / external auditor)	INJ	C33 — added: the two-assessor problem; I17 and I18 differ by role
H1.12	Acquired in period; assessment feasible before the report due date; prior-year exclusion already taken	INJ	E18 — added

H2. Design attributes

ID	Fact	Posture	Consumed by
H2.1	Performer role (a role, never a person)	ASK	B2
H2.2	Frequency	ASK	B2, C2, C5
H2.3	Timing relative to the transaction	ASK	B2, B5
H2.4	Procedure described	ASK	B2
H2.5	Evidence produced	ASK	B2
H2.6	Precision or threshold stated	ASK	B2
H2.7	Control type; control nature	ASK	B4
H2.8	Addresses the stated risk, as described	ASK	B1
H2.9	Relies on an application; relies on internally produced information	ASK	B8, C22
H2.10	Changed during the period; date of change	ASK / INJ	C16, I8a
H2.11	Performer authority and competence attested	ASK	C1, C1a — added: was review-control-only, but the definition of operating effectiveness applies to every control
H2.12	Addresses a significant risk	ASK	C19e
H2.13	Depends on a service organisation; service-auditor report available; report period covers the assessment period	ASK / INJ	C27 — added
H2.14	Entity-level control relied on, and its precision tier	INJ	C26 — added; the tier is the bank's own conclusion, supplied, not derived

H3. Management review control attributes

ID	Fact	Posture	Consumed by
H3.1	Is a management review control	ASK	B6, B7
H3.2	Review threshold band, relative to the materiality bands	ASK	B6a, I7
H3.3	Addresses assertion-level risk; precision factors documented; investigation steps documented; performer authority; information source identified	ASK	B7
H3.4	Evidence of steps performed; evidence of conclusions reached	ASK	B7a
H3.5	Evidenced only by sign-off	ASK	B6b
H3.6	Is a budget or forecast comparison; account complex or unpredictable	ASK	B6c
H3.7	Follow-up of outliers documented	ASK	B6

H4. Test facts

ID	Fact	Posture	Consumed by
H4.1	Procedures performed: inquiry / observation / inspection / re-performance, each a separate flag	ASK	C1b, B9a, I22
H4.2	Population size; population completeness established	ASK	C3g, C10a
H4.3	Full population tested (sampling method)	ASK	C14
H4.4	Sample size tested	ASK	C4
H4.5	Exception count; exception nature; deviation class	ASK	C6–C11
H4.6	Root cause identified	ASK	F12, D3b
H4.7	Untestable items in the sample; combination of controls; performer population count; depends primarily on segregation of duties	INJ	C3a, C3b, C3c, C3g
H4.8	Evidence retained; shows what was done; performer independent of preparer	ASK	C12, C13
H4.9	Evidence shows the performer; evidence dated within the period	ASK	C12 practice legs, I29
H4.10	Specific inquiries made into the deviation; basis for reliance determined	ASK	C10b
H4.11	Sampling method used (random / systematic / haphazard / judgemental); rationale recorded	ASK	C14, I30
H4.12	Test served a dual purpose; the larger required size for the two purposes	ASK / INJ	C31 — added
H4.13	Evidence source class (independent external / entity internal); evidence form (original / copy or conversion); third-party restriction attached; external information supplied electronically by the entity; modification tested or related controls tested	ASK	C32 — added
H4.14	Prior-year test approach (interim period, procedures, extent)	INJ	C30 — added, programme-level and never a determination
H4.15	Control superseded in period; successor achieves the same objectives; successor in place long enough to test	ASK	C29 — added
H4.16	Misstatements the control failed to detect, identified by other work; internal audit reports on this control read	INJ	C33, D3b

H5. Interim, roll-forward and prior-period facts

ID	Fact	Posture	Consumed by
H5.1	Interim test date	INJ	C15, C18
H5.2	Roll-forward performed; roll-forward was inquiry only	ASK	C15a, C15b
H5.3	Changes since interim; exceptions noted at interim; substantially all evidence at interim	ASK	C15a, C15b
H5.4	Interim change enquiry performed	ASK	C16b
H5.5	Prior-period evidence relied on; assessments since last tested	ASK / INJ	C19d, I25
H5.6	Relevance inquiry performed; relevance corroborated by observation or inspection	ASK	C19f
H5.7	Significant manual element; personnel changes affecting application; circumstances indicate the control must change	ASK	C19g
H5.8	Control environment deficient; monitoring process deficient	INJ	C19g

H6. IT and information facts

ID	Fact	Posture	Consumed by
H6.1	ITGC conclusion for the relied-on application, with the scope it covers	INJ	C20, C23b — the conclusion is an assessment result reached outside this graph, and the scope attribute stops it being extended by implication
H6.2	ITGCs currently tested	ASK	C19
H6.3	Unchanged since baseline; baseline age; initial-year assessment	ASK / INJ	C19, C19c
H6.4	Depends on a related data table; related data integrity addressed	ASK	C19b
H6.5	IT controls over the data the control uses were tested	ASK	C23a
H6.6	Internally produced information: completeness and accuracy tested; query logic tested; report parameters checked; sufficiently precise and detailed	ASK	C22, C23
H6.7	Relied-on report records: class, ITGC conclusion, within tested scope, parameters checked, unmodified, change management evidenced, reconciled, completeness and accuracy tested, other procedures performed	INJ	C24, I23

H7. Deficiency facts

Five rows that would have encoded conclusions were removed or recast.

ID	Fact	Posture	Consumed by	Note
H7.1	Deficiency record identity, and which control it belongs to	INJ	D1	Kept. The record is an identifier, not a conclusion.
H7.2	Deficiency type (design / operating)	INJ	D1	Recast. It is not an input the graph then re-derives: where DP1/DP2 run, the graph derives it and the injected value is treated as corroboration; where they disagree the graph emits an input conflict and reaches no determination. DP3 can still run standalone on an injected record.
H7.3	Likelihood band; magnitude band; direction of exposure	INJ	D2, D3, D3a, A13	Bands only, never a percentage or a number.
H7.4	Compensating control: exists; same assertion; tested effective; precision adequate	INJ	D4, D5	Kept as four separate facts, deliberately. These are not D4's conclusion — D4's conclusion is whether severity is reduced, which the graph derives from them. Each is a value the bank holds: whether a control exists, what assertion it addresses, whether it was tested, and at what threshold it operates. The graph never asks "is the compensating control adequate?"
H7.5	Indicator facts (US): fraud by a §302 certifying officer; restatement correcting a material misstatement; material misstatement found by the auditor and not by ICFR; audit committee oversight ineffective; prudent-official test applies	INJ	E7, E7i, E7a	Recast per E7i. The graph asks the underlying facts and never classifies seniority or materiality itself; the consequence of an indicator is derived and is parameter-governed (I16).
H7.6	International significance indicators; material misstatement not prevented or detected; previously communicated and unremediated	INJ	F10f, F10h	Separate relationship from H7.5 so the two indicator postures (I16 / I26) can never be read from one another.
H7.7	Merits attention of those charged with governance; merits management attention	INJ	F10e, I27	The boundary ISA 265 leaves undefined, supplied as a judgement input with no shipped default.
H7.8	Other deficiencies in the group	INJ	D7, D8	Severities removed. The old row imported "other deficiencies … with their severities", which is E1–E8's own output. Each group member is now a deficiency record in its own right, carrying its own likelihood, magnitude and direction facts, and the graph derives every member's severity.
H7.9	Pervasive	INJ	E14	An input per E14, because no primary source defines pervasiveness.
H7.10	Remediated before period end; remediation first performed date; retest sample size; months of operation; retester independent	INJ	D9, D10, I10, I10a–I10c	"Retested over a sufficient period" removed — that was D10/I10's determination. The graph now takes the dates and counts and decides sufficiency itself.
H7.11	Remediation action stated	INJ	D12, F3	Whether an action is stated or proposed, not whether it is adequate.
H7.12	Already communicated in writing by the auditor, internal audit or others	INJ	D13c	The ¶81 relief.
H7.14	Restatement relates to a previously issued period; prior-period determination exists	INJ	E16	The precedence fact. No rule reaches back to the prior determination; this only lets the output say the prior conclusion is not reopened.
H7.13	Reported in the prior year's declaration; publicly disclosed during the year; near miss; significant control failing; improvement area; recurred within the period; disclosure would reveal confidential information	INJ	F4a, F7, F9b, F11, F12, F13	UK-only, injected, so no UK designation is ever asked in a US session.

I. Calibration parameters

Each parameter carries a scope, so static check J4 can be enforced over the parameters as well as the rules: a US-scoped parameter is read only by US-tagged rules and a UK-scoped one only by UK-tagged rules.

Source tags are exactly one of RULE (a fetched primary source states it), PRACTICE (public practice sources only), CONSERVATIVE (a documented choice where the sources are silent) or INPUT (no default; the institution or board must supply it).

ID	Parameter	Scope	Default	Source tag
I1	Framework overlay	CORE	unset, must be supplied	INPUT
I2	Sample size by frequency and risk	CORE	low/medium/high cells: annual 1/1/1; quarterly 2/2/2; monthly 2/3/5; weekly 5/10/15; daily 20/25/30; multiple times daily 25/40/60	PRACTICE, three corroborating public sources, disagreements recorded (C3, C3e)
I2a	Automated control sample size	CORE	1 instance where ITGCs are effective and currently tested; otherwise the frequency size with a floor of 25	PRACTICE (C3f)
I2b	Sample-size rounding	CORE	up, never down; figures are floors not targets	PRACTICE (C3h)
I2c	Multi-performer population split	CORE	each performer, site or system is a separate population, each sampled	PRACTICE (C3g)
I3	Single exception treatment	CORE	deficiency pending evaluation, no sample extension	CONSERVATIVE, a deliberate choice; AS 2201 ¶48 makes a deviation trigger reassessment, and no source permits clearing it by extension
I4	Sample extension switch	CORE	off	CONSERVATIVE
I5	Exception of unknown nature	CORE	treated as systemic	CONSERVATIVE — AS 2315 ¶42 requires the nature and cause to be considered, so an unknown cause cannot be resolved in the control's favour
I6	Materiality bands	CORE	supplied per bank; the graph consumes the band, never the number	INPUT — and RULE as to the posture: the SEC declined to set quantitative thresholds (33-8829) and no UK threshold exists (F5b)
I7	Review control precision margin	CORE	the review threshold must be at or below the band below the one at issue — i.e. strictly below the materiality band, with the margin expressed in bands and never in money	PRACTICE, and an internal calibration rather than a sourced figure: three independent practice sources say only "below", "well below" or "a fraction of" materiality, and NO public source located states a numeric fraction. The calibration guide says so plainly.
I8	Maximum roll-forward gap	CORE	3 months to period end; beyond 6 months roll-forward is unavailable and a fresh test is required	PRACTICE, single-quantitative-source — only one public source gives an explicit numeric trigger (90 days, within a 180–90 day window); two others corroborate 1–3 months as the typical gap without stating a maximum, and AS 2201 ¶56 makes it an uncapped judgement. Flagged in the calibration guide as the weakest-sourced figure in the pack.
I8a	Full-retest triggers (as against roll-forward)	CORE	change of process; change of system; change of the person performing the control; any exception at interim; gap beyond the maximum	RULE for the change and exception legs (AS 2201 ¶56 factor 4; APA 11 pp.28-29), PRACTICE for the elapsed-time leg. Corroborated by three practice sources: "the deciding factor is change", and change triggers a retest regardless of how short the gap is.
I8b	Roll-forward sample size	CORE	proportional to the gap, floor of 1 item, 2–5 items for a key control	PRACTICE, two corroborating sources; a control rarely gets a roll-forward sample of zero
I9	Test of one for automated controls	US	permitted where ITGCs effective and control unchanged	RULE for the four conditions (AS 2201 ¶60, ¶¶B28-B29), subject to the mirror-provenance caveat at C19
I9a	Maximum baseline age	US	36 months	PRACTICE: ¶B33 requires re-establishment "after a period of time" whose length "depends on the circumstances" and states no figure, so the number is practice throughout
I9b	Benchmarking permitted switch	US	on	PRACTICE as to the switch; the conditions it gates are RULE
I9c	Prior-period evidence permitted switch	UK	on	RULE (ISA (UK) 330 ¶¶13-14)
I10	Sufficient period for a remediated control	CORE	daily or more often 3 months; weekly 3 months; monthly 6 months; quarterly 2 quarters, and where remediation lands in the final quarter conclude in the following year; annual the next occurrence of the control	PRACTICE, no authoritative source: the SEC release and the one Big Four public guide both decline to give a number, and the three practice sources that do give figures disagree (a flat 3 months; 6 months for a monthly control; 3–12 months by frequency). The table is the most conservative synthesis of the three and is labelled as such.
I10a	Remediation clock start	CORE	the date the remediated control was first performed as designed, not the date the fix was implemented	PRACTICE inference — no source found is explicit; one source adds a 60–90 day design and implementation phase sitting before the operating clock
I10b	Minimum occurrences to retest a remediated control	CORE	the frequency-appropriate sample size from I2, not the first instance after the fix	PRACTICE, two corroborating sources; closure requires a passing retest, not implementation
I10c	Remediation retester independence	CORE	the retest is performed independently of the person who implemented the remediation	PRACTICE, one source; consistent with the objectivity direction in 33-8810 II.A.2
I11	Aggregation grouping	CORE	same line item, assertion or COSO component	RULE (33-8810 II.B.1; AS 2201 ¶65 Note 2; COSO FAQ for the across-components leg)
I12	Significant deficiency threshold	US	the nine-cell likelihood × magnitude grid: inconsequential magnitude is a deficiency at every likelihood; more-than-inconsequential is a deficiency at remote, a significant deficiency at reasonably possible, and significant-or-material at probable; material magnitude is a significant deficiency at remote and a material weakness at reasonably possible or probable	PRACTICE — two independent public sources publish this grid cell-for-cell identically, which is why it ships as the default; but one of them calls it "a starting point for discussion, not an answer key", and the SEC declined to set quantitative thresholds, so it is a parameter and the output says the mapping was applied. A third source publishes a two-tier materiality-anchored variant instead, recorded as a disagreement.
I12a	SAB 99 five per cent benchmark	US	NOT used	deliberately excluded: it is a materiality rule of thumb, not a deficiency-severity threshold, and loading it as a severity cut-off would be a category error. Recorded so the omission is visible.
I13	Compensating control effect	CORE	may reduce severity only if tested effective and precise	RULE for the precision leg (33-8810 II.B.1; AS 2201 ¶68); CONSERVATIVE for the tested-effective leg, which ¶68 does not state in terms
I14	Key control designation (bank) / material control designation (board)	CORE	no default — the graph never derives either	INPUT (FRC Guidance ¶8: it is not the FRC's role to prescribe what a material control is)
I15	Severity source conflict resolution	US	the auditor standard is the conservative default where primary sources differ in wording	CONSERVATIVE, a deliberate choice; applies only where the SEC and PCAOB texts diverge, which is a US-only situation
I16	Material weakness indicator effect	US	conclusive (indicator alone establishes a material weakness)	CONSERVATIVE — both 33-8810 II.B.1 and AS 2201 ¶69 say only "evaluate"; see I26 for the opposite, sourced default on the international path
I17	Evidence floor source	US	the auditor standard (AS 2201 ¶50: inquiry alone is never sufficient)	RULE; SEC management guidance is more permissive, a documented conflict
I18	Self-assessment admissible as evidence	US	off	CONSERVATIVE — 33-8810 II.A.2.b permits it for management in low-risk areas; AS 2201 ¶18 bars low-objectivity work for the auditor
I19	Deficiency definition source	US	AS 2201 ¶A3	RULE — SEC rules define material weakness and significant deficiency but not "deficiency"
I20	Ambiguous severity cell (more-than-inconsequential magnitude at probable likelihood)	US	significant deficiency, escalating to material weakness where an indicator or the prudent-official test applies	PRACTICE — both corroborating grids leave this single cell as "significant or material", so the graph must resolve it by parameter rather than silently picking one. The output states that the cell is ambiguous in the sources and which way the parameter resolved it.
I21	Sample extension after a deviation	CORE	not permitted to cure a deviation; permitted only to assess the extent of a failure, and recorded as such	PRACTICE, and a direct contradiction between sources: one publishes an escalation ladder (extend 25 → 40 → 60 → fail), another states "do not simply extend the sample" and calls dilution the error auditors challenge. The conservative reading is the shipped default (C7/C8); the contradiction is documented, not hidden.
I22	Evidence hierarchy by risk	CORE	observation or inquiry plus inspection at low risk; inspection of documentation at moderate risk; re-performance at high risk — never inquiry alone at any risk	RULE for the floor (AS 2201 ¶50), PRACTICE for the risk tiering (one source)
I23	IPE testing depth by report class	US	canned report: parameters plus evidence it is unmodified; custom report: parameters plus query logic plus change-management evidence plus reconciliation; ad hoc query: parameters plus logic plus two-way completeness and accuracy testing on each run	PRACTICE, two corroborating taxonomies with different class names; the four elements tested (source, logic, parameters, data) are corroborated by four sources
I25	Maximum assessments since a control was last tested (prior-period evidence)	UK	3 — reliance on earlier evidence is unavailable once a control has gone untested for three consecutive assessments	RULE, and the only hard numeric cap any fetched primary source states: ISA (UK) 330 ¶14(b) requires testing "at least once in every third audit" and ¶A38 repeats it as every third year. Note the standard's own wording differs between audit and year; the requirement paragraph governs, so the graph counts assessments. Unlike every other figure in this table the default is not practice and an institution lengthening it departs from the standard — the calibration guide says so.
I25a	Prior-period evidence availability	UK	permitted below the cap, except where the control changed relevantly or addresses a significant risk, where it is never available	RULE (ISA (UK) 330 ¶¶14(a), 15)
I26	Indicator effect on the international path	UK	NOT conclusive — an indicator raises severity for determination and never establishes it	RULE (ISA (UK) 265 ¶¶8, A6, A7, expressly illustrative). Deliberately the opposite default from I16 on the US path, where the conservative reading of silence is that an indicator is conclusive. Both are sourced; the divergence is documented, and the two parameters are separate so neither overlay can inherit the other's posture.
I27	Boundary between a deficiency meriting management attention and one meriting neither	UK	board or management judgement, supplied as an input	INPUT — ISA (UK) 265 leaves "other deficiency" undefined and gives only likelihood and potential magnitude as the test (¶A22), so no default figure is shipped
I24	Objectivity separations required	CORE	preparer not the reviewer; tester not the control performer; workpaper reviewer not the tester; remediation retester not the implementer	PRACTICE for the four separations (one source each), with the objectivity direction sourced to 33-8810 II.A.2 fn.40 and II.A.2.b
I28	Preventive/detective timing consistency check	CORE	on — a control whose stated timing is inconsistent with its stated preventive or detective type raises a classification correction, never a design deficiency	PRACTICE: no fetched primary source makes the preventive/detective distinction a design criterion; AS 2201 ¶B28's taxonomy is descriptive. Switchable off for institutions that do not record the type (B5)
I29	Evidence attribute legs beyond the sourced floor	CORE	on — test evidence must additionally show the performer and be dated within the period under assessment	PRACTICE: 33-8810 II.A.3 requires retained evidence of the evaluation but does not state that the tester's identity or the test date must be recorded, so these two legs ship as a switchable practice overlay on top of the sourced legs (C12)
I30	Sampling method ranking	CORE	random preferred, then systematic, then haphazard; judgemental admissible only with a recorded rationale	PRACTICE — AS 2315 ¶¶17, 23 and 39 require a representative selection but rank no method, so the ranking is practice and the graph reports the method rather than refusing one (C14)
I31	Interim change enquiry offered on the US path	US	on — the UK requirement is offered as a practice step so the US path can use the same sub-decision	PRACTICE on this path only. ISA (UK) 330 ¶12(a) binds no SEC registrant; AS 2201 ¶56 makes change one of four roll-forward factors rather than a standing enquiry, so the enquiry is a practice offer and its absence never fails a US determination (C16b)
I32	IPE depth tests offered on the UK path	UK	on — the US report-class depth tests are offered as a practice step	PRACTICE on this path only. The IPE obligation is sourced on both paths (C22a), but the report-class depth taxonomy comes from APA 11, a PCAOB publication, so on the UK path it is labelled practice and never cited as authority (C22a, I23)
I33	Service-organisation report evaluation depth	US	on — where a control is performed by a service organisation the determination requires a service-auditor report covering the relevant period and the complementary user-entity controls to be identified and tested	RULE as to the obligation (AS 2201 ¶¶B17-B27 read with ¶19), PRACTICE as to the switch, which exists because a bank with no outsourced controls in scope would otherwise be asked an irrelevant question (C27)
I34	Search obligation below material weakness	US	off — the determination does not require a search for deficiencies of a lesser magnitude	RULE (AS 2201 ¶62: the auditor need not search for deficiencies that, individually or in combination, are less severe than a material weakness). Switchable on for an institution whose own programme sets a lower search floor; switching it on never relaxes a determination (C28)
I35	Tolerable deviation rate	CORE	zero deviations for a sample of fewer than 25 items; otherwise one deviation at a sample of 25 or more, and the rate compared is deviations divided by items tested	PRACTICE: AS 2315 ¶38 requires the deviation rate to be compared with the tolerable rate but states no figure, and the single-exception default (I3) makes one deviation a deficiency pending evaluation rather than a pass, so the figure here governs only the rate arithmetic the output reports (C10, C10a)
I36	Expected deviation rate	CORE	zero — sample sizes in I2 are set on the expectation of no deviations	PRACTICE, and the stated basis of the I2 table in all three corroborating sources: the published sizes assume no expected deviations, so a bank that expects deviations must raise the size rather than accept the published cell (C3, I2)

J. Static checks

ID	Check
J1	Every rule has a source reference and a scope tag.
J2	No rule contains a literal value that section I lists as a parameter.
J3	No institution, client, system or product name appears in the graph, tests or documentation.
J4	The term material weakness appears only in US-tagged rules, US test expectations and the glossary.
J5	The phrase describing a system as ready for production appears nowhere.
J6	The source register lists every document cited by any rule, with URL and date accessed.
J7	Mirror of J4: the term Provision 29 — and any Code or FRC guidance citation — appears only in UK-tagged rules, UK test expectations and the glossary. J4 alone guards one direction; the never-blend rule runs both ways.
J8	No ISA (UK) citation appears in a US-tagged rule, and no PCAOB or SEC citation appears in a UK-tagged rule. A rule tagged CORE carries its citation through an overlay-specific citation rule and never emits both at once (A12). Scope of the ISA limb: ISA 265/315/330 are the bridge between the two overlays, so a CORE rule citing PCAOB text alongside ISA (UK) text is the intended bridge form, not a blend — the never-blend rule is about the two overlay instrument families (PCAOB/SEC on one side, the Code and FRC guidance on the other). The ISA limb is therefore enforced as: no US-tagged rule may impose an ISA requirement the US path does not carry. One US-tagged rule names ISA (UK) 330 ¶12(a) and is compliant on that reading, because its entire content is that the international formulation is a labelled practice recommendation and not a requirement on the US path.
J9	Every value section I lists as a parameter exists as a fact on the policy instance, so a rule reading it has a value to read. J2 guards against literals in rules; this guards the opposite failure — a parameter the rules reference and the data never supplies.

Source register

Every rule in this graph traces to a paragraph in a public primary source. This register is the index: publisher, title, version or effective date, URL, date accessed, and the paragraphs relied on. All sources were fetched on 14 October 2026.

Tier discipline. Tier 1 primary sources are the only source of rules. Tier 2 practice sources supply calibration defaults and worked examples, each labelled PRACTICE and exposed as a named parameter. Tier 3 context shapes test design and commentary only.

Nothing in this pack derives from any institution's own material. No client, prospect or NDA material, no paywalled or licensed firm methodology, no internal audit manual, and no source reached by circumventing an access control was used. Where a document could not be retrieved, that is recorded below rather than filled from recollection.

---

Tier 1 — primary sources (the only source of rules)

United States — SEC and statute

#	Publisher	Title	Version / effective	URL	Paragraphs relied on
P1	SEC	Release Nos. 33-8810; 34-55929; FR-77, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting	72 FR 35324, 20 June 2007	https://www.govinfo.gov/content/pkg/FR-2007-06-27/html/E7-12299.htm	II.A.1 (a-e); II.A.2 (a-c); II.A.3; II.B.1-II.B.5; fn.20, fn.29, fn.40, fn.47, fn.49, fn.52
P2	SEC	Release Nos. 33-8829; 34-56203, Definition of the Term Significant Deficiency	72 FR 44924, effective 10 September 2007	https://www.govinfo.gov/content/pkg/FR-2007-08-09/html/E7-15556.htm	Adopting discussion: the deliberate omission of a likelihood component and the refusal to set quantitative thresholds
P3	SEC / CFR	17 CFR 229.308, Regulation S-K Item 308	as amended through 82 FR 17552	https://www.law.cornell.edu/cfr/text/17/229.308	(a)(2); (a)(3); (a)(4)
P4	SEC / CFR	17 CFR 240.12b-2, Exchange Act definitions	current	https://www.law.cornell.edu/cfr/text/17/240.12b-2	"material weakness"; "significant deficiency"
P5	SEC / CFR	17 CFR 210.1-02(a)(4), Regulation S-X definitions	current	https://www.law.cornell.edu/cfr/text/17/210.1-02	(a)(4)
P6	SEC / CFR	17 CFR 240.13a-15, controls and procedures	as amended through 72 FR 35321	https://www.law.cornell.edu/cfr/text/17/240.13a-15	(c) — the evaluation requirement
P7	US Code	15 U.S.C. 7262 (SOX §404), and 15 U.S.C. 7241 (SOX §302)	current	https://www.law.cornell.edu/uscode/text/15/7262	§404(a), §404(b), §404(c); §302(a)(5)
P8	FDIC / CFR	12 CFR Part 363, Annual Independent Audits and Reporting Requirements	amended 90 FR 55811, effective 1 January 2026	https://www.law.cornell.edu/cfr/text/12/part-363	363.1(a); 363.2(b)(3), incl. (b)(3)(iii); 363.3(b); Appendix A

United States — PCAOB

#	Publisher	Title	Version / effective	URL	Paragraphs relied on
P9	PCAOB	AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements	AS No. 5 (2007) text, substantively unamended; QC 1000 amends ¶.09 and adds ¶.99 effective 15 December 2026	https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201	¶¶.23, .37, .39-.43, .45-.48, .50-.56, .60-.70, .78-.84, .90-.91; Appendix A ¶¶.A3, .A5, .A7, .A11; Appendix B ¶¶.B2, .B9, .B28-.B33
P10	PCAOB	AS 2315, Audit Sampling	current	https://pcaobus.org/oversight/standards/auditing-standards/details/AS2315	¶¶.16-.17, .32, .34-.36, .37 fn.9, .38, .40-.42
P11	PCAOB	AS 1105, Audit Evidence	current	https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105	¶.10
P12	PCAOB	AS 1305, Communications About Control Deficiencies in an Audit of Financial Statements	current	https://pcaobus.org/oversight/standards/auditing-standards/details/AS1305	¶¶.01-.03, .04-.09
P13	PCAOB	Staff Audit Practice Alert No. 11, Considerations for Audits of Internal Control Over Financial Reporting	24 October 2013	https://pcaobus.org/standards/qanda/10-24-2013_sapa_11.pdf	pp.20-29, 34-35; fn.45
P14	PCAOB	AS 6115, Reporting on Whether a Previously Reported Material Weakness Continues to Exist	current; voluntary engagement standard	https://pcaobus.org/oversight/standards/auditing-standards/details/AS6115	Cited only as persuasive analogous guidance on remediation, never as a binding rule

United Kingdom — FRC

#	Publisher	Title	Version / effective	URL	Paragraphs relied on
P15	FRC	UK Corporate Governance Code 2024	published 22 January 2024; applies to accounting periods beginning on or after 1 January 2025, except Provision 29, which applies to periods beginning on or after 1 January 2026	https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/	Provision 29 (all three bullets, scope sentence, footnote 9); Principle O; Provisions 24-28; Application section; footnotes 6-8
P16	FRC	Corporate Governance Code Guidance, Section 4	published 29 January 2024; last updated 3 June 2026; Section 4 clarified 6 March 2024	https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/corporate-governance-code-guidance/	Executive summary ¶8; ¶¶215-219, 243, 248, 250, 259-289, 290-306 — in particular 262, 270-272, 274-276, 277-284, 285-289, 290, 296-300
P17	FRC	Provision 29 Mythbuster: Preparing to report	29 January 2026	https://www.frc.org.uk/docs/9097/html/	The rectified-by-balance-sheet-date answer; the persisting-issue and publicised-issue carve-backs; no model wording; no mandated external assurance
P18	FRC	Provision 29 Mythbuster: auditor responsibilities for the Provision 29 statement	24 June 2026	https://www.frc.org.uk/docs/9420/html/	The declaration as other information under ISA (UK) 720; a significant deficiency does not necessarily contradict a clean declaration
P19	FRC	UK Corporate Governance Code Feedback Statement	22 January 2024	https://www.frc.org.uk/docs/6710/html/	¶¶49-55, in particular ¶54 (the four concessions, including the replacement of "material weakness")
P20	FRC	Provision 29 Mythbuster: Focus on Cyber	23 September 2026	https://www.frc.org.uk/docs/9936/html/	Myths 1, 2, 4, 6 — point-in-time assurance, no incident-reporting duty, no technical detail expected

United Kingdom and international — auditing standards (the ISA 265 bridge)

#	Publisher	Title	Version / effective	URL	Paragraphs relied on
P23	FRC	ISA (UK) 265, Communicating Deficiencies in Internal Control to Those Charged With Governance and Management	cover "Updated September 2025" (published 25 September 2025); running footer still reads "Revised November 2019"; ¶4 effective for audits of financial statements for periods ending on or after 15 December 2010	https://media.frc.org.uk/documents/ISA_UK_265_Updated_September_2025.pdf	¶¶1-3 (scope; no opinion on control effectiveness); ¶5 (objective); ¶6(a)(i)-(ii) and ¶6(b) (the two definitions); ¶¶7-8 (identify, classify); ¶9 (written, timely, to those charged with governance); ¶10(a)-(b) (to management, two limbs); ¶11 (mandatory content of the written communication); ¶A5 (significance without a misstatement); ¶A6 (eight matters bearing on significance); ¶A7 (seven indicators); ¶A8 and fn.5 (combination; cross-reference to ISA 315 ¶A175); ¶¶A10-A11; ¶A12-1 (the UK Corporate Governance Code bridge); ¶A13-1 (public interest entity additional report); ¶A14 (oral does not substitute); ¶A15 (level of detail); ¶A16 (cost irrelevant to the duty); ¶A17 (unremediated prior deficiency); ¶A22 ("other deficiency" test); ¶¶A28-A30
P24	IAASB (text as reproduced by PASAI)	ISA 265 (international, un-amended IAASB text)	¶4 effective for periods beginning on or after 15 December 2009	https://pasai.squarespace.com/s/isa-265.pdf	¶¶4, 6(a)-(b), A5 — used to corroborate the UK text and to record the effective-date divergence
P25	FRC	ISA (UK) 330, The Auditor's Responses to Assessed Risks	(Revised July 2017) (Updated September 2025), published 25 September 2025; ¶2 effective for periods commencing on or after 15 December 2017	https://media.frc.org.uk/documents/ISA_UK_330_Revised_July_2017_Updated_September_2025.pdf	¶11 (period of reliance); ¶12(a)-(b) (the two cumulative interim limbs); ¶¶13(a)-(f) (prior-period evidence factors); ¶14(a)-(b) (continuing relevance; at least once in every third audit); ¶15 (significant-risk prohibition); ¶16 (absence of misstatement proves nothing); ¶17(a)-(c) (the deviation response); ¶A21 (design and implementation is not a test of operating effectiveness); ¶A33 (point in time versus period); ¶A34 (six factors for the remaining period); ¶A35 (how to obtain it); ¶¶A36-A40 (changed/unchanged controls, the third-year interval, the shortening factors, rotation); ¶A41 (material misstatement a strong indicator); ¶A42 (deviation rate against expected rate)
P26	FRC	ISA (UK) 315, Identifying and Assessing the Risks of Material Misstatement	(Revised July 2020) (Updated September 2025), published 25 September 2025; ¶10 effective for periods beginning on or after 15 December 2021	https://media.frc.org.uk/documents/ISA_UK_315_Revised_July_2020_Updated_September_2025.pdf	¶12(d), 12(g), 12(i) (general IT controls, risks arising from the use of IT); ¶¶26(a)-(d) (identified controls; general IT controls; evaluate design and determine implementation); ¶27 (determine whether control deficiencies have been identified); ¶32 (significant risks); ¶33 (substantive procedures alone insufficient); ¶34 (no planned test of operating effectiveness). Paragraph numbers A147-A183 verified first-hand from the printed cross-references; the substantive wording of A166-A183 was NOT retrievable and is not the warrant for any rule — see "what could not be retrieved"

Framework

#	Publisher	Title	Version / effective	URL	Paragraphs relied on
P21	COSO	Internal Control - Integrated Framework, Executive Summary only	2013 edition; 1992 edition superseded after 15 December 2014	https://www.coso.org/_files/ugd/3059fc_1df7d5dd38074006bce8fdf621a942cf.pdf	Definition; the five components; the seventeen principles by number and short name only; "Effective Internal Control" section (p.8); limitations
P22	COSO	Internal Control FAQs (free COSO-published)	2013	https://www.coso.org/_files/ugd/3059fc_8fdac5b8011e4cd08d566bf40b1ac2a8.pdf	Present / functioning / operating together; relevance of principles; aggregation across components; the deferral to external regulators' severity criteria

COSO copyright. The framework itself is copyright and is not public. Only the free executive summary and other free COSO-published PDFs were read. Principles are referenced by number and name, all substance is paraphrased, and no framework body text beyond the public executive summary is reproduced anywhere in this pack.

---

Tier 2 — practice sources (calibration defaults only, never rules)

Every figure drawn from this tier is a named parameter with a documented default, labelled PRACTICE in the requirements and in the calibration guide. Where practice sources disagree, both readings are recorded rather than the inconvenient one being dropped.

#	Publisher	Title	URL	What it calibrated
T1	Center for Audit Quality	Guide to Internal Control Over Financial Reporting (2013, updated May 2019)	https://thecaq.wpenginepowered.com/wp-content/uploads/2019/05/caq_guide_internal_control_over_financial_reporting_2019-05.pdf	Management review controls; the three severity definitions as practitioners restate them; information produced by the entity
T2	Governance Docs	SOX Control Testing: The Clear Guide to Sample Sizes	https://governancedocs.com/sox-control-testing/	Sample-size table (corroboration 1 of 3); no-extension-after-deviation; per-report IPE conclusions
T3	SOXLayer	How many samples? A practical guide to SOX sample sizes by control frequency	https://www.soxlayer.com/blog/sox-sample-sizes-by-frequency	Sample-size table (corroboration 2 of 3); rounding up; frequency as the driver
T4	Chiaro	How many samples does a SOC 2 auditor test?	https://chiarohq.com/soc-2/sample-sizes	Sample-size table (corroboration 3 of 3)
T5	Patron Accounting	Audit Sampling Size Calculator SA 530	https://www.patronaccounting.com/tools/audit-sampling-size-calculator-sa-530	The low/medium/high risk-tiered grid
T6	The Blue Sage Group	Internal Control Testing Guidelines	http://www.thebluesagegroup.com/resources/The%20Blue%20Sage%20Group%20Internal%20Control%20Testing%20Guidelines.pdf	The only explicit numeric roll-forward trigger (90 days; 180-90 day window); a dissenting sample-size table
T7	SOXLayer	Interim vs roll-forward testing	https://www.soxlayer.com/blog/interim-vs-rollforward-testing	Typical gap of one to three months; proportional roll-forward sampling; change as the deciding factor
T8	SOXLayer	Control deficiency, significant deficiency or material weakness? A classification guide	https://www.soxlayer.com/blog/deficiency-classification-guide	The nine-cell severity grid (corroboration 1 of 2); remediation retest independence
T9	BATO	Internal Controls Framework: SOX Compliance	https://bato.com.np/risk/internal-controls-framework-sox-compliance/	The nine-cell severity grid (corroboration 2 of 2); a dissenting remediation period of 3-12 months
T10	Centri Business Consulting	10 Steps to Remediate Material Weaknesses	https://centriconsulting.com/news/insights/remediate-material-weaknesses/	The three-month remediation floor
T11	finrep.ai	Material Weakness in ICFR: Real Examples and Remediation Walkthrough	https://www.finrep.ai/blog/material-weakness-in-icfr-real-examples-and-remediation-walkthrough	By-frequency remediation periods (the more conservative shape adopted)
T12	Deloitte (public DART guide)	Guide for Management - Next Steps After Identifying a Deficiency	https://dart.deloitte.com/USDART/home/publications/deloitte/icfr/evaluate-remediate-internal-control-deficiencies-material-weakness-significant-deficiency	That remediation requires a sufficient period and a sufficient number of instances — and that no number is given
T13	BDO USA	Management Review Controls Mini Guide	https://www.bdo.com/getmedia/5454a7e7-d0a4-4e9b-ba35-c37795fa4302/ASSR_MRC-Mini-guide.pdf	The threshold-relative-to-materiality articulation; aggregation risk lowering the threshold
T14	Grant Thornton	Snapshot 2025-11: Management review controls	https://www.grantthornton.com/content/dam/grantthornton/website/assets/content-page-files/audit/pdfs/snapshot/snapshot-2025-11-management-review-controls.pdf.coredownload.inline.pdf	Evidence beyond sign-off; information-quality procedures by report type
T15	Governance Docs	Management Review Controls: 6 Essential Precision Factors	https://governancedocs.com/management-review-controls/	Independent expectations; the evidence set for a review control
T16	BDO USA	IT Audit Considerations for Information Produced by the Entity	https://www.bdo.com/insights/assurance/it-audit-considerations-for-information-produced-by-the-entity-ipe	Bidirectional completeness and accuracy testing; end-user computing risks
T17	PwC UK	3 simple steps to ensure IPE SOX compliance	https://www.pwc.co.uk/risk/assets/pdf/thinking-outside-sox-ensure-ipe-compliance.pdf	The four tested elements (source, logic, parameters, data); report classification
T18	Schneider Downs	IPE: Populations and Key Reports	https://www.schneiderdowns.com/our-thoughts-on/ipe-populations-and-key-reports/	Report classes; population completeness evidence
T19	Linford & Company	Audit Sampling Methods & Best Practices	https://linfordco.com/blog/audit-sampling/	The statistical basis of the conventional sizes; the dissenting extension ladder

---

Tier 3 — context only (never a source of rules)

#	Publisher	Title	URL	Why it is here
C1	BCBS / BIS	Framework for Internal Control Systems in Banking Organisations (BCBS 40, 1998)	https://www.bis.org/publ/bcbs40.htm	What supervisors expect of a bank's control system — informs what a UK board may treat as material, nothing more
C2	BCBS / BIS	Corporate governance principles for banks (BCBS 328, 2015)	https://www.bis.org/bcbs/publ/d328.htm	Three lines of defence; independence of risk, compliance and internal audit
C3	EBA	Guidelines on internal governance, EBA/GL/2021/05	https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-internal-governance-under-crd	Title V internal control framework expectations
C4	FCA	Handbook SYSC 4.1, 4.3, 6.1, 6.2, 24.2	https://www.handbook.fca.org.uk/handbook/SYSC/4/1.html	Robust governance and periodic evaluation of internal control mechanisms
C5	PRA	Rulebook: General Organisational Requirements; Compliance and Internal Audit	https://www.prarulebook.co.uk/pra-rules/general-organisational-requirements	The UK prudential counterpart to SYSC
C6	UK Code 2018	UK Corporate Governance Code 2018, Provision 29	https://www.frc.org.uk/docs/5167/html/	Superseded. Recorded only as the transitional position until the 2024 Provision 29 bites. Not a source of any rule.

---

Watch items — instruments with known pending revision

An instrument with a known pending revision is recorded as a watch item and is not relied on as a source.

• AS 2201 ¶.09 and new ¶.99 — amended by QC 1000, effective 15 December 2026. The amendment is quality-control housekeeping and touches none of the paragraphs this graph relies on, but the version is dated in the documentation.
• FRC Corporate Governance Code Guidance is a live web page whose paragraphs have been renumbered at least once (5 November 2025). Every citation is pinned to the numbering live on 14 October 2026 and must be revalidated before any production use.
• The FRC continues to issue Provision 29 Mythbusters — three to date. They shape interpretation without amending the Code or guidance, and the first FRC commentary on actual Provision 29 reporting is expected in 2027.
• ISA (UK) 700 (revised) is effective 15 December 2026, which may affect how the Provision 29 statement is handled as other information.
• UK audit reform primary legislation (and ARGA) is not in force; in January 2026 the Government stated it would not consult on audit reform legislation. Provision 29 remains a comply-or-explain Code obligation, not a statutory one.
• FDIC Part 363 thresholds are CPI-W indexed under 12 CFR 314.1 and move over time. They are recorded as context and appear in no rule.

---

What could not be retrieved, and what follows from that

Recorded honestly, because a gap filled from recollection would breach the source constraints.

• PCAOB AS 2201 ¶¶.B26-.B33 (the benchmarking appendix) were recovered from a third-party mirror, not from the PCAOB original, because pcaobus.org returns 403 to the fetcher. The benchmarking rules (C19-C19c) rest on these paragraphs and must be verified against the PCAOB original before any production use. This is flagged in the documentation.
• SEC Release 33-8810 Sections III.C-III.F were not retrieved: the govinfo text truncated mid-Section III. Section III is the cost-benefit and regulatory-flexibility analysis, which carries no rules; no requirement rests on it.
• The authoritative FRC PDFs could not be text-extracted (media.frc.org.uk returns 403). The Code text and the three disclosure elements were taken from FRC-hosted HTML conversions that carry an FRC accuracy disclaimer, and were corroborated across three or more separate FRC documents. The exact Provision 29 sentence should be verified against the authoritative PDF before production use.
• COSO's full framework and the ICEFR Compendium are sold, not published. Their existence is noted; they were not consulted. COSO's own glossary definitions of "deficiency" and "major deficiency" sit in the full publication, so they are paraphrased from a free COSO-published summary article and are not used as rule text.
• The AICPA Audit Sampling guide is a paid publication; its sample-size tables are not legitimately reproducible and were not reproduced. Only the published description of their scope and confidence level is recorded.
• The IIA management guide and one firm's §404 FAQ could not be reached (redirects and a bot wall respectively). Neither was needed: the figures they would have corroborated are corroborated by other public sources.
• ISA (UK) 265, 315 and 330 are published only as PDFs on media.frc.org.uk, which returns 403 to a direct fetch. They were read through a public text-extraction proxy over the same FRC URLs, which is why the paragraph numbering, requirement text and A-paragraph headings are first-hand but the rendering is a conversion.
• ISA (UK) 315 ¶¶A166-A183 could not be extracted: every attempt truncated near ¶A95. The paragraph numbers and their subject matter are first-hand (from the requirement paragraphs' own cross-references), but the substantive wording of A166-A183 is secondary-sourced only. No rule in this graph rests on that wording, and it must be confirmed against the authoritative PDF before any production use.
• The September 2025 updates to the three ISAs (UK) carry no commencement note and no change log in the documents themselves. The effective-date paragraphs still carry the earlier revision dates, so the effective dates recorded above are the ones printed in the standards, not the update date.

---

Conflicts between primary sources, and how each is resolved

Where primary sources differ in wording the auditor standard is the conservative default, the choice is exposed as a parameter, and the conflict is documented.

Conflict	SEC management guidance	PCAOB auditor standard	Resolution
The evidence floor	Permits self-assessment by control operators in lower-risk areas, with lower evidential weight (33-8810 II.A.2.b)	Inquiry alone is never sufficient (AS 2201 ¶50)	Auditor standard is the default (parameter I17); self-assessment admissibility is a parameter, off (I18)
"Deficiency"	Defined nowhere in the SEC rules, which define only the two upper severities	Defined at AS 2201 ¶A3 with design and operation limbs	Auditor definition used (parameter I19)
Material weakness indicators	"Indicators" to be evaluated (33-8810 II.B.1)	"Indicators" to be evaluated (AS 2201 ¶69)	Neither says conclusive or rebuttable. Encoded conclusive — the conservative reading — exposed as parameter I16
Significant deficiency threshold	Deliberately omits a likelihood component; declines quantitative thresholds (33-8829)	Purely comparative definition (¶A11)	No mapping exists in either. The grid is practice, parameter I12, and the output says the mapping was applied
Remediation period	No minimum stated (33-8810 fn.20)	No remediation paragraph at all	Practice only, parameter I10, with no rule tag
Governance body	—	"Those responsible for oversight", never the ISA phrase	US overlay uses the PCAOB term; the ISA phrase belongs to the UK path only

Divergences between the US standards and the ISAs (UK), and how each is resolved

These are not resolved by preferring one text: the two overlays are kept separate, so each path takes its own source's posture and neither inherits the other's.

Divergence	US position	ISA (UK) position	Resolution
What makes a deficiency	Design or operation (AS 2201 ¶A3)	Designed, implemented or operated, or a necessary control missing (ISA 265 ¶6(a))	The international limbs are wider. The implementation limb and the missing-control limb are encoded in the core (F1c, F10d) because they add coverage the US text does not contradict
Indicators of severity	Evaluated; neither text says conclusive (AS 2201 ¶69)	Expressly illustrative, and the practitioner must still determine significance (ISA 265 ¶¶8, A6, A7)	Two separate parameters, deliberately opposite: I16 conclusive on the US path, I26 not conclusive on the international path
Period of reliance and the interim gap	AS 2201 ¶¶.55-.56 require roll-forward but set no interval	ISA 330 ¶12(a)-(b) states two cumulative obligations; ¶A34 lists six factors; no text quantifies the gap	Independent second confirmation that the gap must be a practice parameter (I8) and not a rule
Prior-period evidence	AS 2201 ¶¶.B26-.B33 benchmarking, with no stated interval	ISA 330 ¶14(b)/¶A38 caps reliance at at least once in every third audit	The only hard numeric cap any fetched primary source states. Shipped as parameter I25 tagged RULE, with the note that lengthening it departs from the standard
Nil reporting	AS 1305 requires communication of what is found	ISA 265 ¶9 is triggered only by an identified significant deficiency; ¶3 is permissive	No nil-report obligation on either path (F10i)
Boundary of "other deficiency meriting management attention"	No counterpart	ISA 265 ¶A22 gives a test but no boundary	Supplied as an input with no shipped default (I27)

Internal inconsistencies inside the ISAs (UK) as published

Recorded rather than silently smoothed; none is load-bearing for a rule.

• ISA 265 effective date. The UK text (¶4) runs from periods ending on or after 15 December 2010; the IAASB text runs from periods beginning on or after 15 December 2009. Both are recorded; neither affects a determination.
• ISA 330 A-paragraph cross-references. The requirement paragraphs' printed references to A-paragraphs do not line up with the A-paragraph topic headings as printed. Requirement paragraph numbers are therefore cited as primary, and A-paragraph attributions follow the printed headings.
• ISA 330 ¶14(b) versus ¶A38. The requirement says "every third audit"; the application material says "every third year". For an annual reporting cycle these coincide; the requirement's wording is the one encoded.
• Dual-purpose testing sits at ¶A23, not in a requirement paragraph, so it informs commentary and not a rule.

Citation corrections the sources required

Version checks were run on every instrument, and three citations in the original specification did not survive the check. None changes the method.

1. "Persuade a reasonable person" is not in AS 2201. ¶46 says "persuade the auditor", and "reasonable person" appears nowhere in the standard. The nearest analogue is the prudent-officials test at ¶70, which the graph encodes as a fifth material weakness indicator.
2. The severity definitions sit at ¶.A3, ¶.A7 and ¶.A11, not at the paragraphs the specification cited. ¶.A5 defines ICFR itself.
3. Release 33-8810 has no Section II.C. Its outline is I / II.A (with II.A.1 a-e, II.A.2 a-c, II.A.3) / II.B (II.B.1-5) / III. Evidence evaluation is at II.A.2.
4. The FDICIA small-institution exemption is at 12 U.S.C. 1831m(j) with a $150,000,000 statutory floor. Part 363's own thresholds were raised effective 1 January 2026 (applicability to $1bn; management ICFR assessment and auditor attestation to $5bn).

Requirement to rule coverage

Produced mechanically from the shipped graph: every rule name carries its scope tag, the requirement IDs it implements (at any position in the name) and its source reference, so this map is read off graph.xml rather than maintained alongside it.

Measure	Value
Rules in the graph	865
Rules by scope tag	CORE 441 · US 247 · UK 177
Requirement IDs defined in the register	259
Register IDs carried by at least one rule	218
Rule-name IDs with no register entry	0 (three acceptance-scenario references, R4, R5 and X2, appear in rule names beside the requirement they exercise)
RULE-kind requirements with no rule	3, all prohibitions enforced by a static check rather than by a rule: A7 and F8 (the never-blend rule, checks J4 and J7) and C16e (no standard-derived numeric gap threshold, check J2)

Rule counts by requirement ID

ID	Section	Kind	Scope tags on its rules	Rules
A1	A	RULE	CORE	8
A3	A	RULE	US	8
A4	A	RULE	UK	1
A5	A	INPUT	UK	3
A6a	A	RULE	US	3
A6b	A	OUT	US	1
A8	A	DEF	CORE	1
A9	A	RULE	CORE	1
A11	A	OUT	CORE	1
A12	A	CHK	UK, US	9
A13	A	RULE	CORE	1
B1	B	RULE	CORE	6
B2	B	RULE	CORE	20
B3	B	RULE	CORE	9
B3a	B	DEF	CORE	1
B4	B	RULE	CORE	19
B5	B	PARAM	CORE	5
B6	B	RULE	CORE	4
B6a	B	RULE	CORE	2
B6b	B	RULE	CORE	1
B6c	B	RULE	CORE	2
B7	B	RULE	CORE	5
B7a	B	RULE	CORE	3
B8	B	RULE	CORE	7
B9	B	RULE	CORE	7
B9a	B	RULE	CORE	1
B9b	B	RULE	CORE	2
B9c	B	RULE	CORE	1
B10	B	OUT	CORE	19
C1	C	RULE	CORE	6
C1a	C	RULE	CORE	7
C1b	C	RULE	CORE	5
C1c	C	RULE	CORE	1
C2	C	RULE	CORE	9
C3	C	PARAM	CORE	2
C3a	C	RULE	CORE	4
C3b	C	RULE	CORE	3
C3c	C	RULE	CORE	1
C3d	C	RULE	CORE	2
C3f	C	PARAM	CORE	10
C3g	C	RULE	CORE	3
C3h	C	PARAM	CORE	1
C4	C	RULE	CORE	9
C5	C	RULE	CORE	1
C6	C	RULE	CORE	4
C7	C	RULE	CORE	6
C8	C	PARAM	CORE	2
C9	C	RULE	CORE	5
C10	C	RULE	CORE	9
C10a	C	RULE	CORE	6
C10b	C	RULE	UK	7
C10c	C	RULE	UK	1
C11	C	RULE	CORE	3
C12	C	SPLIT	CORE	17
C13	C	RULE	CORE	6
C14	C	RULE	CORE	8
C15	C	RULE	CORE	11
C15a	C	RULE	CORE	6
C15b	C	RULE	CORE	9
C16	C	RULE	CORE	8
C16a	C	RULE	CORE	6
C16b	C	RULE	UK, US	5
C16c	C	RULE	UK	1
C16d	C	RULE	CORE	1
C17	C	PARAM	CORE	7
C18	C	RULE	CORE	1
C19	C	RULE	CORE, US	12
C19a	C	RULE	US	4
C19b	C	RULE	US	7
C19c	C	RULE	US	6
C19d	C	RULE	UK	13
C19e	C	RULE	UK	8
C19f	C	RULE	UK	6
C19g	C	RULE	UK	8
C19h	C	DEF	UK	1
C20	C	RULE	CORE, UK	20
C20a	C	RULE	US	1
C21	C	PARAM	US	1
C22	C	RULE	CORE	24
C22a	C	PARAM	UK, US	3
C23	C	RULE	US	3
C23a	C	RULE	US	2
C23b	C	RULE	US	1
C24	C	RULE	US	2
C24a	C	DEF	CORE	1
C25	C	OUT	CORE	4
C26	C	RULE	US	7
C27	C	PARAM	US	8
C28	C	PARAM	US	2
C29	C	RULE	US	8
C30	C	PARAM	US	2
C31	C	RULE	CORE	2
C32	C	RULE	US	6
C33	C	DEF	US	5
D1	D	RULE	CORE	5
D2	D	INPUT	CORE	3
D3	D	INPUT	CORE	3
D3a	D	RULE	US	5
D3b	D	RULE	CORE, US	3
D4	D	RULE	CORE	9
D5	D	RULE	CORE	7
D6	D	PARAM	CORE, US	5
D7	D	RULE	CORE	25
D7a	D	RULE	CORE	2
D8	D	PARAM	CORE	13
D8a	D	RULE	CORE	1
D9	D	RULE	CORE	18
D10	D	RULE	CORE	13
D11	D	PARAM	CORE	7
D12	D	RULE	CORE	13
D13	D	RULE	CORE, US	18
D13a	D	RULE	CORE, US	2
D13b	D	DEF	UK, US	2
D13c	D	RULE	US	10
D13d	D	RULE	CORE, US	2
D14	D	RULE	US	8
E1	E	RULE	US	4
E1a	E	DEF	US	1
E2	E	RULE	US	4
E3	E	RULE	US	6
E4	E	RULE	US	4
E5	E	PARAM	US	1
E6	E	RULE	US	7
E6a	E	RULE	US	1
E6b	E	RULE	US	1
E6c	E	RULE	US	1
E6d	E	RULE	US	1
E7	E	RULE	US	10
E7a	E	RULE	US	8
E7b	E	RULE	US	1
E7i	E	DEF	US	1
E8	E	RULE	US	3
E10	E	RULE	US	19
E11	E	RULE	US	15
E11a	E	RULE	US	5
E12	E	RULE	US	2
E13	E	RULE	US	5
E14	E	OUT	US	8
E15	E	RULE	US	2
E16	E	RULE	US	5
E17	E	RULE	US	4
E18	E	RULE	US	7
F1	F	RULE	UK	6
F1a	F	DEF	UK	1
F1b	F	DEF	UK	3
F1c	F	RULE	UK	5
F2	F	RULE	UK	7
F3	F	RULE	UK	5
F3a	F	OUT	UK	2
F3b	F	DEF	UK	1
F4	F	RULE	UK	6
F4a	F	RULE	UK	3
F4b	F	RULE	UK	4
F4c	F	RULE	UK	1
F4d	F	RULE	UK	1
F5	F	RULE	UK	6
F5a	F	INPUT	UK	3
F6	F	RULE	UK	6
F6a	F	DEF	UK	3
F7	F	RULE	UK	2
F9a	F	RULE	UK	10
F9b	F	RULE	UK	2
F10	F	RULE	UK	14
F10a	F	DEF	UK	2
F10b	F	DEF	UK	1
F10c	F	DEF	UK	2
F10d	F	DEF	UK	2
F10e	F	RULE	UK	21
F10f	F	RULE	UK	3
F10g	F	RULE	UK	2
F10h	F	RULE	UK	2
F10i	F	RULE	UK	6
F11	F	RULE	UK	7
F12	F	RULE	UK	2
F13	F	OUT	UK	2
F14	F	OUT	UK	1
G1	G	OUT	CORE, UK, US	16
G2	G	OUT	CORE	1
G3	G	OUT	CORE, UK, US	31
G4	G	OUT	CORE	1
G5	G	OUT	CORE, UK, US	24
G6	G	OUT	CORE, UK, US	78
G7	G	OUT	CORE, UK, US	33
G8	G	OUT	CORE, UK, US	36
G9	G	OUT	CORE, UK, US	21
G10	G	OUT	CORE	2
G11	G	OUT	UK	1
G12	G	OUT	UK	1
G14	G	OUT	CORE	2
I1	I	PARAM	CORE	2
I2a	I	PARAM	CORE	3
I2c	I	PARAM	CORE	2
I5	I	PARAM	CORE	2
I8	I	PARAM	CORE	1
I9c	I	PARAM	UK	1
I10	I	PARAM	CORE	2
I10a	I	PARAM	CORE	4
I10b	I	PARAM	CORE	7
I10c	I	PARAM	CORE	8
I11	I	PARAM	CORE	12
I13	I	PARAM	CORE	3
I16	I	PARAM	US	7
I17	I	PARAM	CORE	1
I20	I	PARAM	US	2
I21	I	PARAM	CORE	1
I22	I	PARAM	CORE	3
I23	I	PARAM	US	9
I24	I	PARAM	CORE	5
I25	I	PARAM	UK	2
I26	I	PARAM	UK	2
I27	I	PARAM	UK	8
I29	I	PARAM	CORE	6
I30	I	PARAM	CORE	3
I31	I	PARAM	US	1
I32	I	PARAM	UK	1
I35	I	PARAM	CORE	1
I36	I	PARAM	CORE	1
J4	J	CHK	US	3

Register IDs that correctly carry no rule

Parameters are facts on the policy instance read by the rules that need them; definitions and inputs fix vocabulary or name a fact the institution supplies; output obligations are discharged by the narrative channel of their decision point; static checks are enforced mechanically.

Kind	IDs
CHK (8)	J1, J2, J3, J5, J6, J7, J8, J9
DEF (3)	A10, E3a, F5b
INPUT (1)	A6
OUT (3)	E9, F9, G13
PARAM (23)	A2, C3e, I2, I2b, I3, I4, I6, I7, I8a, I8b, I9, I9a, I9b, I12, I12a, I14, I15, I18, I19, I25a, I28, I33, I34
RULE (3)	A7, C16e, F8

Requirement IDs rendered under more than one scope tag

A12 (UK/US), C16b (UK/US), C19 (CORE/US), C20 (CORE/UK), C22a (UK/US), D3b (CORE/US), D6 (CORE/US), D13 (CORE/US), D13a (CORE/US), D13b (UK/US), D13d (CORE/US), G1 (CORE/UK/US), G3 (CORE/UK/US), G5 (CORE/UK/US), G6 (CORE/UK/US), G7 (CORE/UK/US), G8 (CORE/UK/US), G9 (CORE/UK/US). A CORE requirement that needs an overlay-specific citation, summary or instrument line is rendered by rules tagged to that overlay (register entry A12), so the same requirement ID legitimately appears under more than one tag.