databases for this purpose, creating data fields within their risk and control documentation to capture this information. Rate each key control for "control failure risk (CFR)" and "ICFR risk" CFR is applied at the individual control level, based on factors in the guidance related to complexity of processing, manual vs. automated nature of the control, judgment involved, etc. Management fundamentally asks the question: "How difficult is it to execute this control properly each and every time?" With account misstatement risk and CFR defined, management can then conclude on ICFR risk (low, medium, or high) for the control. ICFR is the key risk concept used in evidence decisions. The ICFR rating is captured for each control statement. Larger companies typically have hundreds of significant accounts, risk statements, and control statements. These have a "many to many" relationship, meaning risks can apply to multiple accounts and controls can apply to multiple risks. Consider the impact of risk on the timing, nature, and extent of testing The guidance provides flexibility in the timing, nature and extent of evidence based on the interaction of Misstatement Risk and Control Failure Risk (together, ICFR Risk). These two factors should be used to update the "Sampling and Evidence Guide" used by most companies. As these two risk factors increase, the sufficiency of evidence required to address each MMR increases. Management has significant flexibility regarding the following testing and evidence considerations, in the context of the ICFR risk related to a given control: Extent (sample size): The sample size increases proportionally to ICFR risk. Nature of evidence: Inquiry, observation, inspection and re-performance are the four evidence types, listed in order of sufficiency. Evidence beyond inquiry, typically inspection of documents, is required for tests of control operating effectiveness. Re-performance evidence would be expected for the highest risk controls, such as in the period-end reporting process. Nature of the control (manual vs. automated): For fully automated controls, either a sample size of one or a "benchmarking" test strategy may be used. If IT general controls related to change management are effective and the fully automated control has been tested in the past, annual testing is not required. The benchmark must be periodically established. Scope of roll-forward testing required: As risk increases, roll-forward testing is increasingly likely to be necessary to extend the effect of interim testing to year-end. Lower-risk controls presumably do not require roll-forward testing. Pervasive factors that also