AC557's Unit 3 control design matrix gives each of fourteen risks at a composite metal recycler one control with its precision stated; nine are marked key. Searches like "ac 557 unit 3 assignment example", "ac557 unit 3 sample" and "ac557 unit 3 example" land here.
What a finished AC557 Unit 3 control design matrix looks like
A matrix of fourteen rows and eleven columns printed across two facing pages, followed by a page of notes. Each row carries a risk reference from the worksheet, the control's reference, the control statement, preventive or detective, automated, manual or IT-dependent manual, entity or process level, frequency, precision, key or non-key, the evidence produced and the COSO principle served, 10, 11 or 12. Row seven reads: each operating day, the yard controller reviews the prior day's override report, investigates every override whose price variance exceeds 150 dollars against the grade photo and seller history, records the resolution and signs off in the scale system by ten the next morning. Two entity-level controls head the matrix, including a monthly report of the general manager's overrides sent to the parent's controller.
How a AC557 Unit 3 example is structured
The one-to-one rule is kept deliberately: where a risk seemed to need two controls, the notes explain whether it was really two risks. Control statements follow a fixed pattern, performer, frequency, what is examined, the threshold that triggers follow-up and what happens then, because a review with no threshold cannot be failed and therefore cannot be tested. Precision gets its own column since it decides whether a detective control could catch a misstatement large enough to matter. IT-dependent manual controls are flagged, and the notes name the report each relies on, which later testing must cover for completeness and accuracy. Key status is justified in a sentence per row. Automated controls cite the general controls they depend on, change management above all, under principle 11. Preventive controls outnumber detective ones eight to six.
One risk, one control
Fourteen rows, fourteen controls. Two early drafts paired a risk with two controls, and the notes explain how each was split into separate risks instead.
A fixed pattern for every statement
Performer, frequency, what is examined, the threshold for follow-up and the response, so each control could fail in a way a tester would notice.
Precision in its own column
The override review looks at variances above 150 dollars; the tonnage reconciliation investigates differences over 1.5 percent of a yard's monthly weight.
Reports the controls lean on
Five IT-dependent manual controls, each naming the system report it relies on, such as the daily override report, flagged for completeness testing later.
Nine key, five not, each explained
Key controls are those whose failure would leave an assertion unaddressed; the five non-key rows duplicate coverage or serve compliance alone.
Where marks go in AC557 Unit 3
Loose control statements, the yard controller reviews overrides, draw the first and largest deduction because nothing in them could be observed failing. Graders then check the mapping: controls addressing a risk other than the one in their row, or risks left without any control, break the chain the course is built on. Review controls without a threshold or precision are marked down even when the performer and frequency are clear. Confusing IT-dependent manual controls with automated ones hides the report that later testing must cover. Key designations with no reasoning read as guesses. A matrix swollen with routine activities tied to no listed risk is harder to test, and it tends to show that the analysis stopped short of the worksheet. Principle numbers misapplied cost smaller amounts.
Get a AC557 Unit 3 example written to your instructions
Bring the risks from your Unit 2 work or the list the Unit 3 prompt hands out, with the rubric and any matrix template the section uses. Each risk gets one control with performer, frequency, precision and exception response written out, delivered within 24-48h. The first custom matrix is free.
AC557 Unit 3 questions, answered
What does precision mean for a review control?
The size of error a review would detect. A controller who investigates every override above 150 dollars has a stated precision; one who looks over the report for anything unusual has none. Precision matters because a detective control supports a conclusion only if it would catch misstatements smaller than what could matter, which is why the matrix gives it a column.
What makes a control IT-dependent manual?
A person performs it, but using system-generated information, such as a report of overrides. If that report omits tickets, the review fails without anyone knowing. The matrix flags these controls so the testing units cover the report itself, checking that it is complete and accurate, as well as the person's review of it.
Why only one control per risk?
Many AC557 prompts ask for a clean mapping, and one control per risk forces the analysis to decide which control actually addresses the risk. Where two controls seemed necessary, the sample found two risks hiding in one row. Real organizations layer controls, and later units return to that when compensating controls come up.