Describe the compensating controls and whether they were tested. If compensating control has not been tested, provide an explanation for not performing your test work.
Do not describe controls that mitigate the impact of the affected application controls. Such an evaluation, if necessary, will be performed in ”Summary of Internal Control Deficiencies (Process Level Controls)”."