The process of evaluating and classifying an individual process/transaction-level control deficiency incorporates the evaluation of quantitative and qualitative factors. This sample questionnaire can be used to document and analyze exceptions identified during individual process/transaction-level control testing.

Sample questions include: When was the exception identified? Who identified the exception (e.g., the entity’s management or the auditor)? Does this exception relate to an actual misstatement?