Audit Planning & Assurance Intelligence

174 days old as of 2026-07-01

Two SOC report exceptions lack documented management responses.

Cited control

ctl-010 · DETECTIVE · ANNUAL

PARTIAL

tested 2025-12-15

This issue records a COE failure, shown first.

Procedures evaluating whether the control operated over the testing period.

1.Select 25 critical vendors and confirm each SOC report was reviewed within the annual cadence.
2.For reports with exceptions, confirm a documented management response exists.
3.Confirm vendors without a current SOC report on file were escalated for a compensating assessment.

Procedures evaluating whether the control is designed adequately.

1.Obtain and read the vendor SOC review procedure; confirm it defines the critical-vendor population and the annual review cadence.
2.Confirm the procedure requires documented follow-up on report exceptions, not just receipt of the report.

Same root cause or a shared entity

Issue-pressure points as of 2026-07-01, before the factor is capped at 0–100.

Third-Party Loan Servicer12 of 15 pts
80% of this entity’s issue pressure
Annual priority score: 38 · issue pressure carries 20% weight in the active model — one factor among several behind that score.
- MODERATE severity: 12
Vendor Risk Management12 of 12 pts
100% of this entity’s issue pressure
Annual priority score: 32 · issue pressure carries 15% weight in the active model — one factor among several behind that score.
- MODERATE severity: 12