Quick practice question for you all. You’re testing a quarterly user access review. The control owner sends you: - A spreadsheet showing all users reviewed - Manager approvals - A completion date within the required quarter Everything looks good at first. But you notice the employee population came directly from the control owner. You don’t have anything showing that the list is complete or came from the system of record. Would you pass the control? A) Yes, the review was completed and approved B) No, the population completeness hasn’t been validated C) Pass it, but document the limitation D) Request another manager approval Drop your answer below. I’ll post how I’d approach it from an auditor/control-testing perspective later today.