Control: On a monthly basis, each component controller performs a comparison of operating results to budget amounts for their respective component. Variances in excess of US$25,000 are investigated. Deficiency: Within our sample of 2 months, we identified 3 instances in which variances in excess of US$25,000 were not investigated and resolved. All components were tested and each of the 3 instances occurred at the same component location. Which is the appropriate information to be included in Part IV of the SOCD form for this control deficiency? 

That all other component locations are in-scope and were tested by the audit team 

This is a deficiency in operation because the variances were not investigated and resolved timely 

That we have not modified our control risk assessment as a result of this deficiency 

This control is a direct entity-level control because it deals with the review of performance results by segment