Control: On a monthly basis, each component controller performs a comparison of operating results to budget amounts for their respective component. Variances in excess of US$25,000 are investigated. Deficiency: Within our sample of 2 months, we identified 3 instances in which variances in excess of US$25,000 were not investigated and resolved. All components were tested and each of the 3 instances occurred at the same component location. Which is the appropriate information to be included in Part IV of the SOCD form for this control deficiency? This is a deficiency in operation because the variances were not investigated and resolved timely That all other component locations are in-scope and were tested by the audit team That we have not modified our control risk assessment as a result of this deficiency This control is a direct entity-level control because it deals with the review of performance results by segment