CSD-RT RFP Recordkeeping_Administration Services Response 3-

260 / 499

This report is intended for use by the management of the Variable Annuity Life Insurance Company ("VALIC") and its subsidiaries.
VALIC Retirement Services Company ("VRSCO") and VALIC Financial Advisors, Inc. ("VFA"), its user entities, and the independent
auditors of its user entities, and is not intended and should not be used by anyone other than these specified parties. Click VALIC.com 53
Control Objective 2 - Controls provide reasonable assurance that modifications to non-monetary participant data
are properly authorized and are completely and accurately recorded.
VALIC Control Activities Tests of Operating Effectiveness Results of Tests
2.6 A report is generated for non-
monetary participant updates
resulting from an internal rollover
request which is reviewed and
approved by new business
management.
Inspected a sample of New Business-
SOX (NB-SOX) reports to determine
whether non-monetary participant
updates were reviewed and approved
by management. For NB-SOX reports
that contained corrections noted
on the review, inspected supporting
documentation to determine whether
the update was investigated and
resolved in a timely manner.
No exceptions noted.
2.7 Participants are authenticated
within the application
using a unique User ID and
passwords that are in accordance
with AIG Policy.
Observed a Business Analyst log in
to participant account to
determine whether a unique User ID
and password were required.
Observed password parameter
requirements when resetting a
password to determine whether they
are in accordance with AIG Policy.
No exceptions noted.
No exceptions noted.
2.8 An index file of the scanned
documents is routed to AWD
for processing. The job that
routes the image file to AWD is
monitored for processing.
Observed evidence of the Windows
service used to transfer the index file
of the scanned documents to AWD.
Observed the configuration to
monitor for errors to determine
whether notifications are sent to the
appropriate individuals in the event of
a process failure.
No exceptions noted.
No exceptions noted.
IV. VALIC control objectives and controls, and PricewaterhouseCoopers LLP's tests of operating
effectiveness and results of tests