Risk & Compliance Posture

Castellan Financial Services — Live as of Jan 15, 2025

Material Weaknesses
2
+1 QoQ
SOX Control Pass Rate
91%
-3% vs target
Regulatory Filings On-Time
100%
✓ 12/12 Q4
Critical Vendor Risk
34
Tier 1 vendors
Open Finding Exposure
$18M
42 findings >90d
Privacy Incident MTTR
36h
-12h vs Q3

Control Test Failures by Process & Severity

Critical
High
Medium
Low
ITGC
3
5
2
1
Revenue Recognition
0
2
4
3
Payments
1
6
3
2
Payroll
0
1
2
4
Procurement
0
2
5
1
Financial Close
0
1
3
2

Finding Aging & Dollar Exposure

Critical Vendor Risk Score (Tier 1)

Top Risk Findings Register (14 Open)

ID Finding Title Process Severity Exposure ($) Age (Days) Owner SLA Status
F-2401 Privileged Access Review Failure — Production DB ITGC Critical $4,100,000 142 J. Patterson (IT) Breached
F-2402 CloudLedger SOC 2 Lapsed — No Attestation Procurement Critical $3,200,000 98 M. Chen (Vendor) Breached
F-2403 Payment Approval Workflow Bypass — Mobile App Payments High $2,700,000 86 R. Gupta (Ops) Due 12d
F-2404 Revenue Cut-Off Testing Gaps — Q4 Close Revenue High $1,900,000 62 A. Silva (Finance) On Track
F-2405 PII Data Retention Policy Exception — 18 Systems Privacy High $1,500,000 54 K. Liu (Privacy) On Track
F-2406 Change Management Unapproved Deploy — Prod ITGC Medium $980,000 41 J. Patterson (IT) On Track
F-2407 Segregation of Duties — AP Approver & Processor Procurement Medium $720,000 38 M. Chen (Vendor) On Track
F-2408 Backup Recovery Test Overdue — DR Plan ITGC Medium $610,000 29 J. Patterson (IT) On Track

SOX Control Pass Rate Trend (12 Months)

Policy Exception Rate by Area

Privacy Incidents (Q4 2024)

8
Down from 14 in Q3

Insurance Coverage Gap Index

22%
Cyber liability gap $4.2M

Regulatory Exam Readiness

94%
Evidence complete for 18/19 controls