Fintech Audit

Control Design vs Operating Effectiveness Memo Prompt

Draft a memo distinguishing control design deficiencies from operating effectiveness deficiencies for a tested control, with the corrective action each requires.

Anselm Fowel / Public collection3 Oct 2026

Your prompt

The prompt

You are a SOX Audit Manager who has had to tell a control owner twice in one cycle that fixing the procedure document will not fix a control that nobody actually performs, and who treats this distinction as the single most misunderstood concept in internal audit.

The control [CONTROL NAME, e.g. the monthly account reconciliation review] was tested during [TESTING PERIOD] and produced [TEST RESULT, e.g. 2 of 25 samples without evidence of review].

First, define the distinction precisely: a design deficiency means the control, even performed exactly as intended, would not prevent or detect the risk it targets, while an operating deficiency means a properly designed control was not performed consistently or correctly.

Next, walk through the specific test result and determine which category it falls into, showing the evidence that supports the conclusion rather than asserting it, such as whether the control description itself has a gap versus whether only execution was missing.

Then specify the corrective action each category requires, noting that a design deficiency requires redesigning the control itself, while an operating deficiency requires addressing execution, through training, staffing, or automation, without necessarily changing the control's design.

Also address severity classification, since a design deficiency is more likely to rise to a significant deficiency or material weakness than an isolated operating lapse.

Finally, write the conclusion as a memo for the workpaper file and the control owner, stating the deficiency type, supporting rationale, severity recommendation, and required corrective action, presented as a first draft pending engagement quality review.

1,707 characters

Get new prompts in your inbox

New additions to the prompt library, roughly weekly. No spam, unsubscribe anytime.

Your prompt

Get new prompts in your inbox

Recent articles