S4-m4

Question 1

The service auditor, when auditing the service organization, is required to:

Answer 1

-establish, prior to acceptance of the SOC engagement, and understanding with service organization management about its responsibilities of the service auditor
-communication with the management of the service org
-determine the appropriate persons within the service organizations management or governance structure with whom to interact

Question 2

The objectives of the service auditor are to:

Answer 2

obtain reasonable assurance about whether, in all material respects, based on suitable criteria:
-managements description of the service organization system fairly presents the system that was designed and implemented
- the control related to the control objectives stated were suitably designed
-when included in the scope, the controls operated effectively
-report in accordance with the service auditors findings

Question 3

During planning of any SOC engagement, the service auditor is responsible for:

Answer 3

-determining whether to accept or continue the engagement
-agreeing on engagement terms
-reaching an understanding with management regarding a written assertion

Question 4

During planning of a SOC 1 engagement, the service auditor is also responsible for:

Answer 4

-assessing the risk of material misstatement
-obtaining an understanding of the service orgs system and assessing the suitability of the criteria used by management in preparing its system description

Question 5

During planning of a SOC 2 & 3 engagement, the service auditor is also responsible for:

Answer 5

-establishing an overall strategy for the engagement; sets scope timing, direction
-performing risk assessment procedures; how system controls were designed, implemented, and operated to provide reasonable assurance

Question 6

Agreed upon engagement terms

Service auditor and service organization

Answer 6

-objectives and scope
-responsibilities of the service auditor and the responsible party, including the responsibility o management to provide a representation letter
-identification of the criteria used to measure, evaluate, or disclose information about the subject matter
-acknowledgment that the engagement will be conducted in accordance with attestation standards established

Question 7

Service Organization and Service Auditor

Independence Considertations

Answer 7

the service auditor needs to be independent with respect to the responsible party. The responsible party is most often the service organization

Question 8

Subservice Organization and Service Auditor

Independence Considertations

Answer 8

If management elects to use the inclusive method, then the subservice organization management is a responsible party and should be independent of the service auditor

Question 9

What should the service auditor d when they lack independence?

Answer 9

when the service auditor is required by law to accept the engagement the service auditor should disclaim an opinion and should specifically state the service auditor is not independent

Question 10

The service auditors consideration of materiality should include…

SOC 1

Answer 10

the fair presentation of the description of the service organizations system

Question 11

Fair presentation of the description relates to…

The concept of materiality

Answer 11

the information being reported on, not the financial statements of user entities

Question 12

Materiality relates to…

SOC 1

Answer 12

qualitative factors, such as whether significant aspects of the processing have been included in the description or if relevant information has been omitted or distorted

Question 13

Quantitative factors

Materiallity with respect to SOC 1 T 2

Answer 13

The tolerable and observed rate of deviations

Question 14

Qualitative factors

Materiallity with respect to SOC 1 T 2

Answer 14

The nature and cause of deviations

Question 15

Materiality can be described as:

SOC 2

Answer 15

• the likelihood and magnitude of the risks that threaten the achievement of the service organizations service commitments and system requirements
  -whether the controls the service organization has designed, implemented, and operated were effective in mitigating those risks to an acceptable level based on the applicable trust services criteria

Question 16

The service auditor should consider the nature of threats…

SOC 2

Answer 16

and the likelihood and magnitude of the risks arising from those threats to the achievement of the service organization service commitments and system requirements

Question 17

Description Misstatement

Answer 17

The term used when describing errors or omission in the description of the service organizations system

Question 18

Deviation Expectation

Answer 18

identified misstatements resulting from the failure of a control to operate in a specified instance. A deviation may result in a deficiency

Question 19

Deficiency in the design

Answer 19

when a control necessary to meet control objectives is missing or improperly designed so that even if it operates as designed, control objectives would not be achieved

Question 20

Deficiency in the operating effectiveness

Answer 20

when a properly designed control fails to operate as designed or when the person performing the control does not possess the competency necessary to perform the control effectively

Question 21

In a SOC 2 engagement what is a system?

Answer 21

a system is defined as the infrastructure, software, procedures, and data that are designed, implemented, and operated by people to achieve one or more of the organizations specific business objectives in accordance with management specified requirement

Question 22

What are the boundaries of a system?

Answer 22

are the specific aspects of a service organizations infrastructure, software, people, procedures, and data necessary to provide its services.
-need to be clearly defined and communicated to report users in a SOC engagement

Question 23

Service commitments are…

Answer 23

declarations made by service organization management to user entities and others about the system used to provide the service

Question 24

System requirements are…

Answer 24

specifications regarding how the system should function to meet the service organization service commitments, to comply with relevant laws and regulations and guidelines of industry groups, and to achieve other objectives of the service organization that are relevant to the trust services category or categories addressed by the description
-also define how the system should function to meet commitments, comply with laws

Question 25

Objectives and sub-objectives relate to:

Answer 25

-the achievement of service commitments made to user entities related to the system used to provide the services and system requirements necessary to achieve those commitments
-service commitments may also be established for one or more of the trust service categories addressed by the description
-compliance with laws and regulations regarding the provision of the services by the system
-the achievement of the other objectives the service org has for the system

Question 26

A service organizations management is responsible for:

Answer 26

-achieving its service commitments and system requirements
-disclosing the principal system requirements and service commitments in the system description in a manner that allows SOC 2 report users to understand how the controls operate and how management and the service auditor evaluated the suitability of the controls
-disclosing service commitments that are relevant to the common needs of the broad range of SOC 2 report users

Question 27

When deciding whether the disclosures stated in the description are appropriate, the service auditor should consider whether:

Answer 27

-the service commitments are presented in sufficient detail for report users to understand the relationship between the controls implemented by the service organization, the service commitments and system requirements
-the description summarizes the principal service commitments that are common to such reports users when the SOC 2 report is designed for a broad range of users

Question 28

In a SOC engagement, when does risk assessment begin?

Answer 28

it begins with the service organization identifying and assessing the types, likelihood, and impact of risks that affect the preparation of the description, the suitability of the design of controls, and the operating effectiveness of controls (type 2) within the system

Question 29

Risks in a SOC engagement

Answer 29

-intentional and unintentional internal and external acts
-identified threats and vulnerabilities to, and deficiencies of , the system
-use of subservice organizations that store, process, or transmit sensitive info
-type of employee personnel with access to the system
-a lack of CUECs or CSOCs

Question 30

Inherent risks

Answer 30

the risk present before the consideration of controls

Question 31

In all SOC engagements risk assessment primarily focuses on…

Answer 31

inherent risks that affect the preparation of the description of the system and the effectiveness of the service organizations controls

Question 32

In a T1 or T2 engagement, the risk of material misstatement relates to the risk that in all material respects based on the criteria in managements assertion:

Answer 32

1. Managements description of the service org system is not fairly presented
2. the controls are not suitably designed to provide reasonable assurance that the control objectives stated in managements description of the service org system would be achieved if the controls operated effectively
3. The controls did not operate effectively throughout the specified period to achieve related control objectives stated in managements description of the service organizations system

Question 33

The service auditors risk assessment procedures to obtain an understanding of the service organization system may include:

Answer 33

-inquiry
-observing operations and inspecting documents
-inspecting a selection of agreements between service org and its user entities and business partners
-reperforming the application of a control
-reading relevant reports received from regulators, internal auditors, or other specialist’s

Question 34

Service auditors risk assessment procedures may be performed:

Answer 34

-within a walk-through
-concurrently with procedures performed to obtain info about whether system description is presented in accordance with the description criteria and whether the controls were suitably designed and operated effectively to meet objectives

Question 35

The service auditor should also perform risk assessment procedures to identify any fraud risk or risk of noncompliance with laws or regulations. Risk include:

Answer 35

-managment override of controls
-misappropriation of assets
-the creation of false or misleading documents or records

Question 36

Materiality definitions and interpretations vary between SOC 1 and SOC 2 engagements but in both cases, the service auditor is required:

Answer 36

to reassess materiality if the auditor obtains new information that would have caused the auditor to assess the initial materiality differently