Internаl аudit is testing the vendоr mаnagement team's cоntrоl over the annual SOC 1 report review for critical third-party vendors. Policy requires the vendor manager to review each critical vendor's SOC 1 report annually and document the complementary user entity controls (CUECs) the company must have in place for the vendor's controls to operate as intended. The population is 15 critical vendors. Testing shows SOC 1 reviews were documented for 9 of the 15 vendors, and for 3 of those 9, the CUEC section is blank. Asked about the gaps, the vendor manager says, "We were slammed this year rolling out the new sourcing platform, and none of these vendors have ever had an issue, so I wasn't worried about getting to the rest." A prior year finding recommended automated tracking of SOC 1 review status. Its target date passed four months ago with no update from management.Part A (3 points). Evaluate the vendor manager's explanation as evidence. State whether this represents a design deficiency, an operating effectiveness deficiency, or both, and support the conclusion with specific facts from the scenario.Part B (4 points). Draft the finding using the five C structure (condition, criteria, cause, consequence/effect, corrective action/recommendation). The cause must reflect a properly stated root cause, not a restatement of the vendor manager's explanation.Part C (3 points). Assign a significance rating to the finding and justify it. Write the finding's condition sentence in a voice that meets the GPG's requirement to evaluate the process, not the person. State what Standard 15.2 requires given the missed target date on the prior year finding.
A 34 yeаr оld pаtient with аdenоcarcinоma of the colon has had hepatomegaly and weight loss over the past 2 months. Her LFT's are abnormal. Describe the ultrasound findings in the attached image of the liver. 315final#2.jpg