CSD-RT RFP Recordkeeping_Administration Services Response 3-

271 / 499

This report is intended for use by the management of the Variable Annuity Life Insurance Company ("VALIC") and its subsidiaries.
VALIC Retirement Services Company ("VRSCO") and VALIC Financial Advisors, Inc. ("VFA"), its user entities, and the independent
auditors of its user entities, and is not intended and should not be used by anyone other than these specified parties.
6.6 An index file of the scanned
documents is routed to AWD
for processing. The job that
routes the image file to AWD is
monitored for processing.
Observed evidence of the Windows
service used to transfer the index file
of the scanned documents to AWD.
Observed the configuration to
monitor for errors to determine
whether notifications are sent to the
appropriate individuals in the event of
a process failure.
No exceptions noted.
No exceptions noted.
6.7 Complaints are monitored by
management and the Consumer
Affairs Department.
Inspected a sample of monthly
complaint reports to determine
whether customer complaints are
monitored by VALIC Management and
the Compliance Department.
No exceptions noted.
Click VALIC.com 64
Control Objective 6 - Controls provide reasonable assurance that benefit payments are properly authorized and
processed accurately, completely, and in accordance with instructions received from plan sponsors or participants
and in compliance with the plan document.
VALIC Control Activities Tests of Operating Effectiveness Results of Tests
6.4 Participants are authenticated
within the application
using a unique User ID and
passwords that are in accordance
with AIG Policy.
Observed a Business Analyst log in
to participant account to
determine whether a unique User ID
and a password were required.
Observed password parameter
requirements when resetting a
password to determine whether they
are in accordance with AIG Policy.
No exceptions noted.
No exceptions noted.
6.5 ​Incoming participant callers to
the Contact Center are verified
before providing any participant
or account specific information
to the caller or performing any
transactions for the caller.
Inspected a sample of incoming
participant calls to confirm that
prior to the release of confidential
participant or account information,
the VALIC team member verifies the
following: participant's name, Social
Security number or VALIC account
number, and date of birth.
No exceptions noted.
IV. VALIC control objectives and controls, and PricewaterhouseCoopers LLP's tests of operating
effectiveness and results of tests