<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body >See question below:<br><br><br>-------- Original message --------<br>From: "Sheehy, Don (CA - Toronto)" <dosheehy@deloitte.ca> <br>Date: 01/21/2014 11:42 AM (GMT-07:00) <br>To: ben@digicert.com <br>Subject: question on 17.9 of baseline <br> <br><br>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div> </div>
<div> </div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Can you pose this to the forum</span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;"> </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">“17.9 Regular Quality Assessment of Technically Constrained Subordinate CAs </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">During the period in which a Technically Constrained Subordinate CA issues Certificates, the CA which signed the </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Subordinate CA SHALL monitor adherence to the CA’s Certificate Policy and the Subordinate CA’s Certification </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Practice Statement. On at least a quarterly basis, against a randomly selected sample of the greater of one certificate </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">or at least three percent of the Certificates issued by the Subordinate CA, during the period commencing </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">immediately after the previous audit sample was taken, the CA shall ensure all applicable Baseline Requirements are </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">met. </span></font></div>
<div> </div>
<ol style="margin:0;padding-left:36pt;">
<font face="Arial" size="2"><span style="font-size:10pt;">
<li>Has the Forum established how they will get evidence that the population the subordinate says have issued is accurate to choose the 3%</li><li>What specifically will be checked since the cert is technically constrained ? – ie what are the applicable baseline Requirements that will be tested ( this sould be agreed for consistency)</li><li>The evidence for the 3% checking will then need to be kept for the auditors for the baseline audit.</li></span></font>
</ol>
<div> </div>
<div> </div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Thanks </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;"> </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">Don</span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;"> </span></font></div>
<div> </div>
<div> </div>
<div><font face="Arial" size="2" color="#000066"><span style="font-size:10pt;"><b>Donald E. Sheehy, CPA, </b><font color="navy"><b>CA, CISA, CRISC, CIPP/C</b></font></span></font></div>
<div><font face="Verdana" size="1" color="#000066"><span style="font-size:8pt;">Partner | Enterprise Risk </span></font></div>
<div><font face="Verdana" size="1" color="#000066"><span style="font-size:8pt;">Deloitte </span></font></div>
<div><font face="Arial" size="1" color="#004994"><span style="font-size:8pt;">30 Wellington St Wt, PO Box 400, Stn Commerce Crt, Toronto, ON M5L 1B1</span></font></div>
<div><font face="Arial" size="1" color="#004994"><span style="font-size:8pt;">Direct: 416-601-5863 | Main: 416-601-6500</span></font></div>
<div><font face="Arial" size="1" color="#004994"><span style="font-size:8pt;">Fax: 416-601-6400 | Mobile: 416-301-2350</span></font></div>
<div><a href="mailto:name@deloitte.ca"><font face="Arial" size="1" color="blue"><span style="font-size:8pt;"><u>dosheehy@deloitte.ca</u></span></font></a><font face="Arial" size="1" color="#004994"><span style="font-size:8pt;"> | </span></font><a href="http://www.deloitte.ca/"><font face="Arial" size="1" color="blue"><span style="font-size:8pt;"><u>www.deloitte.ca</u></span></font></a></div>
<div><font color="#004994"> </font></div>
<div><font face="Arial" size="1" color="#00A8E6"><span style="font-size:8pt;">Deloitte is proud to be an Official Supplier </span></font></div>
<div><font face="Arial" size="1" color="#00A8E6"><span style="font-size:8pt;">of the Canadian Olympic team </span></font></div>
<div> </div>
<div><font face="Arial" size="1" color="#92D400"><span style="font-size:7.5pt;">Please consider the environment before printing. </span></font></div>
<div> </div>
<div> </div>
<div> </div>
</span></font>
<p>Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system. Thank you. <br>
Information confidentielle: Le présent message, ainsi que tout fichier qui y est joint, est envoyé à l'intention exclusive de son ou de ses destinataires; il est de nature confidentielle et peut constituer une information privilégiée. Nous avertissons toute personne autre que le destinataire prévu que tout examen, réacheminement, impression, copie, distribution ou autre utilisation de ce message et de tout fichier qui y est joint est strictement interdit. Si vous n'êtes pas le destinataire prévu, veuillez en aviser immédiatement l'expéditeur par retour de courriel et supprimer ce message et tout document joint de votre système. Merci.</p></body>