What's the best design/configuration for Quarterly PBC Requests e.g. application's user access reports/outputs and certifications/reviews?

Audit Program - SOX <Year>

Test Phase - Q1, Q2, Q3 or Q4?

Control - Control ID for the SOX App/System's quarterly user access reports/outputs and/or user access certifications/reviews

Type - General