EFTA01356562

Appendix 2 — For new / amended controls — sample size required to demonstrate sustainability The below table provides the sample size required to evidence adequacy of new amended control execution over a sustainable penod The relevant samples should be attached to the closure evidence for each control listed in section 2 by the Finding Owner as part of his closure submission and refered to in section 3 of the closure pack. A sample size of 2 means 2 distinct examples of evidence of the control operating (eg. If control is evidenced through actions taken at a meeting based on information presented — two meeting packs and minutes). Note that the findings management policy require the finding owner to build the sustainability period in their action plan • Automated IT Control 1 Annually 1 Semiannually 7 Quarterly 2' Monthly 3 Weekly 10 Daily 20 Multiple times per day 25 ' For findings validation, the sample see can be reduced if not available by the Target Date and or by end of validation period If the control is operating to an ad hoc frequency and sample selection cannot be determind based on the table above. the ad-hoc control table (see below) wIl be utilised. T•tal • ' • currencem . last l2 . Ic size 2 2 3.4 2 5-12 3 13-52 10 53-365 20 >365 25 For internal use only Pap 11d12 CONFIDENTIAL - PURSUANT TO FED. R. CRIM. P. 6(e) DB-SDNY-0042470 CONFIDENTIAL SDNY_GM_00188654 EFTA01356562