SOC Planning and Performance

Question 1

What is the job of SERVICE AUDITORS in SOC 1 examinations?

Answer 1

Service Auditors determine if management’s description of the service organization’s system is FAIRLY STATED IN ALL MATERIAL RESPECTS, based on the criteria in management’s assertion

Question 2

What is a FAIRLY STATED management description of the service organization’s system?

Answer 2

It is one that meets the needs of the intended report users

Question 3

What does a SOC 1 EXAMINATION do?

Answer 3

It provides assurance about how the service organization affects user entities’ internal controls over financial reporting

Question 4

What should the service auditor do to determine if MISSTATEMENTS are MATERIAL?

Answer 4

• Consider the effect of uncorrected mistakes
• Whether misstatements are significant enough to suggest a failure to meet specific criteria

Question 5

What is an UNQUALIFIED OPINION?

Answer 5

• This opinion provides the reader of the financial statements assurance that the financial statements give a true and fair view, meaning they are free from misstatements or errors
• “UNQUALIFIED OPINION WITH AN EMPHASIS ON MATTER” statement is also a good opinion to have.

Question 6

What is a QUALIFIED OPINION?

Answer 6

It is an opinion that indicates that the financial statements are true and fair, except for ONE issue

Question 7

What is an ADVERSE opinion?

Answer 7

It is an opinion that indicates to financial statement users that the auditors conclude that the financial statements don’t give a true and fair view

Question 8

What is a SCOPE LIMITATION?

Answer 8

This opinion is when the auditor cannot obtain enough audit evidence to conclude if the financial statements as a whole are NOT free from material misstatements

Question 9

Who are the intended users of a SOC 2 report?

Answer 9

• Service organization management
• Specified parties who have sufficient knowledge and understanding of its system
• SOC 2 IS A RESTRICTED REPORT, meaning that intended users must have a direct relationship with the service organization

Question 10

What do SOC 2 reports REPORT ON?

Answer 10

• They provide assurance about CONTROLS related to SECURITY, AVAILABILITY, PROCESSING INTEGRITY, CONFIDENTIALITY, AND PRIVACY (AKA SOC 2 Trust Services Criteria)
• SOC 2 reports help user entities understand a service organization’s system and controls

Question 11

For each vendor that management classifies as a SUBSERVICE ORGANIZATION, management must choose to use:

Answer 11

• INCLUSIVE or CARVE-OUT method
• These methods provide report users with the info necessary to assess the full set of controls included in the service organiation’s system

Question 12

What happens under the CARVE-OUT METHOD?

Answer 12

• Management explains the nature of the subservice organization’s services but not its controls, in the description of the service organization’s system
• Complementary User Entity Controls (CSOC) are reported separately after management’s system description

Question 13

What do the boundaries of a service organization’s system include?

Answer 13

Infrastructure
Software
Data
Procedures
Employees

Question 14

If a utility company provides no other services:

Answer 14

Management would classify it as a VENDOR

Question 15

To classify a 3rd party provider as a SUBSERVICE ORGANIZATION, all of the following apply except:

Answer 15

• 3rd party’s services affect the delivery of the service organization’s services to user entities
• 3rd party’s services are important to user entities of the service organization’s system
• 3rd party’s controls must be combined with the service organization’s controls to provide reasonable assurance of achieving the service organization’s objectives

Question 16

What is an example of when a service organization would classify the 3rd party as a vendor, and NOT a subservice organization?

Answer 16

• When the service organization’s controls include monitoring the 3rd party’s technology
• If the service organization’s controls are sufficient by themselves, management doesn’t need to explain the vendor’s services in the description of the system

Question 17

What is DC?

Answer 17

Description Criteria for a Description of a Service Organization’s System in a SOC 2 report

Question 18

DC Section 100

Answer 18

• SOC for Cybersecurity examinations
• They type of info that needs to be disclosed in this examination is to include the principal types of sensitive info created, collected, transmitted, used, or stored

Question 19

DC Section 200

Answer 19

SOC for organization’s system description

Question 20

DC Section 300

Answer 20

SOC for Supply Chain examinations

Question 21

When do description misstatements occur?

Answer 21

• They occur when management improperly includes or omits information
• Statements that are not measurable increase the risk of material misstatement

Question 22

What does management’s description of the service organization’s system also include WHEN the INCLUSIVE method is used for 1+ subservice organizations?

Answer 22

It includes the subservice organization’s control objectives and controls

Question 23

In all SOC examinations (NOT SOC 1), what serves as suitable criteria for measuring/evaluating controls?

Answer 23

Trust Services Criteria (AICPA)

Question 24

The AICPA Trust Services Criteria ___ with the COSO Framework and EXTEND the guidance to measure or evaluate controls related to security, availability, processing integrity, confidentiality, or privacy

Answer 24

ALIGN

Question 25

Supplemental trust services criteria ____ upon COSO Internal Control, part of the control activities component

Answer 25

EXPAND

Question 26

Supplemental trust services criteria relate to what?

Answer 26

Logical and physical access controls System operations Change management Risk mitigation

Question 27

All SOC 2 examinations must include what category?

Answer 27

Security

Question 28

What does the Trust Services Criteria address?

Answer 28

They address the relevant aspects of a CYBERSECURITY PROGRAM

Question 29

What are Complementary User Entity Controls?

Answer 29

They are controls which a service organization's management has assumed would be implemented by user entities to provide assurance that the service organization's objectives would be achieved

Question 30

Regarding subsequent discovery of facts, the service auditor may seek the service organization's _____ in performing additional procedures and revising the report. HOWEVER, the service organization MAY REFUSE TO notify intended users NOT to rely on the report.

Answer 30

COOPERATION

Question 31

What is one precondition to a SOC examination?

Answer 31

Management must take responsibility for identifying risks (AKA service organization must perform its own risk assessment BEFORE a SOC examination)

Question 32

When a service organization's management chooses the CARVE-OUT METHOD for a subservice organization during a SOC engagement, what must management's description explicitly state?

Answer 32

It must state that the description does not extend to complementary subservice organization controls (CSOCs)

Question 33

During a SOC 1 examination, if a service auditor identities a misstatement, what should they do?

Answer 33

- They should tell the service organization management to modify the description - This action allows the service auditor to maintain independence and allows management to explain the discrepancy

Question 34

Service auditors performing SOC engagements should be___ of the service organization and any SUBSERVICE organizations using the INCLUSIVE METHOD

Answer 34

INDEPENDENT

Question 35

Do service auditors need to be INDEPENDENT of USER ENTITIES?

Answer 35

NO

Question 36

Who are intended users of SOC 2 reports?

Answer 36

User entities and business partners

Question 37

To classify a vendor as a SUBSERVICE ORGANIZATION, ALL of the following must apply

Answer 37

- The 3rd party's services affect the delivery of the service organization's services to user entities - The 3rd party's services are important to user entities' understanding of the new service organization's system - The 3rd party's controls must be combined with the service organization's controls to provide reasonable assurance of achieving the service organization's control objectives

Question 38

A service auditor needs a ___ from the management of the service organization during the reporting phase of a SOC engagement

Answer 38

REPRESENTATION LETTER The representation letter should be the same date as the service auditor's report

Question 39

In a SOC 2 examination, what must the responsible party provide in the management representation letter?

Answer 39

The letter must state that the responsible party (the service organization's management) the access to all relevant info.

Question 40

If the subservice organization is not CONTRACTUALLY required to participate in the SOC engagement, what happens?

Answer 40

the service organization's management must use the carve-out method for the subservice organization

Question 41

Many of the trust services criteria include what phrase?

Answer 41

"To meet the entity's objectives"

Question 42

Where does the term "objecetive" come from?

Answer 42

COSO Internal Control--Integrated Framework, because the Trust Services Criteria was developed from this

Question 43

Service auditors performing SOC engagements must be ___ of service organizations and ALL SUBSERVICE orgnizations under the INCLUSIVE METHOD

Answer 43

INDEPENENT

Question 44

The boundaries of a service organization's system includes what?

Answer 44

Infrastructure Software Data Procedures Employees necessary to provide services to user entities

Question 45

What is INFRASTRUCTURE?

Answer 45

It comprises the physical and virtual IT hardware Facilities Servers Storage Networks

Question 46

What is the only assertion management would make in a SOC 3 engagement?

Answer 46

That the controls included in the description of the system OPERATED EFFECTIVELY throughout a period based on the trust services criteria

Question 47

What are 2 threats to independence?

Answer 47

1) Management participation 2) Self-review

Question 48

What criteria must a fairly stated description in a SOC 2 examination meet?

Answer 48

DC 200 Description Criteria

Question 49

What is materiality in the eyes of a service auditor?

Answer 49

- Misstatements - Qualitative and quantitative factors - Circumstances, nature, size, and extent of misstatements

Question 50

What are service commitments?

Answer 50

They are promises the service organization made to customers regarding the performance of its systems

Question 51

For each vendor classified as a subservice organization, the service organization must choose whether to use:

Answer 51

Inclusive method OR Carve-out method

Question 52

IN order for a subservice organization to be treated under the INCLUSIVE METHOD, what must happen?

Answer 52

- The subservice organization must agree to be a responsible party (must make written assertations, cooperate with the service auditor's examination, and provide a management representation letter) - IF the subservice organization refused to cooperate, then the CARVE-OUT method would be used

Question 53

Trust Services Criteria is used for SOC 2 and SOC 3 for

Answer 53

Measuring or evaluating controls

Question 54

Out of the 5 Trust Services Criteria categories, which one must be included by the SOC 2 examination?

Answer 54

SECURITY

Question 55

Which 2 SERIES of the Trust Services Criteria apply to all 5 Trust Services CATEGORIES of Security, Availability, Processing Integrity, Confidentiality, and Privacy?

Answer 55

COMMON SUPPLEMENTAL

Question 56

With whom can the SOC 1 report be shared?

Answer 56

User entities User auditors

Question 57

Who would be an appropriate intended user of SOC 2 report?

Answer 57

Business partners

Question 58

Who is a NONISSUER?

Answer 58

IT IS A COMPANY that is not subject to regulation by the SEC, but they must follow AICPA standards

Question 59

Who would be interested in a SOC 2 report?

Answer 59

Government regulators

Question 60

What are service auditors not required to do regarding subsequently discovered facts?

Answer 60

They are not required to perform procedures regarding subsequently discovered facts

Question 61

What are the 4 phases of a SOC engagement?

Answer 61

1) Acceptance 2) Planning 3) Performing 4) Reporting

Question 62

What does AT-C 320 list?

Answer 62

Control criteria to evaluate the subject matter of SOC 1 examinations

Question 63

What does AT-C 205 list?

Answer 63

It lists performance and reporting requirements