N
Since you say Div. 3’s locations all have similar functions and processing systems, then we would consider it one cycle and they would likely have the same control activities at each location. I would pick a sample of locations to test. If a control failed at more than one location (or 3 out of 10), then we would consider it 1 deficiency (but all 3 locations would share responsibility for the remediation plan).
For Div. 2, since they have unique financial processing systems, we would likely consider each of those to be separate SOX cycles. For example, if Div. 2 had a warehouse in Texas and a warehouse in Oklahoma and they used totally different inventory management systems, then we might have Sox cycle called ‘Texas Inventory’ and one called ‘Oklahoma Inventory’ and the control activities, narratives, etc. could be different. And in that case you could have deficiencies for each location. Of course, we would also do a scoping exercise and some locations might not warrant being a SOX cycle due to immateriality.