S4-m5 Flashcards
Key areas of engagement performance once initial risk assessment procedures are complete:
- Respond to risk
- Evaluate whether managements description is fairly presented in accordance
- Obtain and evaluate evidence regarding suitability of the design of controls
- Obtain and evaluate evidence regarding the operating effectiveness of controls
- Evaluate the results of the procedures
- Form the opinion
The service auditor is required:
Responding to the Assesed Level of Risk
- obtain sufficient audit evidence to reduce attestation risk to an acceptably low level
- to design and implement overall responses to address the assessed risk of material misstatements for the subject matter; and design and perform further procedures whose nature, extent and timing are based on, and responsive to, the assessed risk of material misstatement
Assessment of risks of material misstatement is impacted by several factors, including:
-material considerations
-the service auditors understanding of the effectiveness of the control environment
-other openness of internal control related to the service provided to user entities and business partners
Overall responses by the service auditor to address the assessed risks of material misstatement may include:
- maintaining a culture of professional skepticism with the engagement team
-assigning more experienced staff or using specialists as needed
-providing additional supervision over audit procedures
-incorporating elements of unpredictability in the selection of procedures to be performed
-making changes to the nature, extent, or timing of procedures
A description is not fairly presented if:
- the description states or implies that controls are being performed when they are not being performed
-the description inadvertently or intentionally omits relevant controls performed by the service organization that are not suitably designed or operating effectively
The service auditor is required to obtain and read managements description of the service org system and evaluate whether those aspects of the description that are included in the scope of the engagement are presented fairly, in all material respects, based on the suitable criteria in managements assertion, including whether:
SOC 1
-the control objectives stated in managements description of the service organizations system are reasonable in the circumstances
-control identified in managements description of the service organization system were implemented
-complementary user entity controls and complementary subservice organization controls, if any are adequately described
-the services performed by a subservice organization, if any are adequately described, including whether the carve out method or inclusive method has been used
The attributes of suitable criteria for evaluating the fair presentation of managements description includes:
SOC 1
-whether managements description of the service org system presents how the service or system was designed and implemented, including the types of services, procedures, information used, how system captures and addresses significant events
-whether managements description of the service organization system includes relevant details of changes to the service organizations system during the period covered
-whether managements description of the service org system does not omit or provide misleading info relevant to the service orgs system
Procedures the service auditor may perform to evaluate whether the description of the service organization system is fairly presented typically include a combination of the following:
-considering the nature of the user entities and how the services provided by the service organization are likely to affect them
-reading contracts with user entities to gain an understanding of the service organizations contractual obligations
-observing the procedures performed
-reviewing the service organizations policy
-walkthroughs
A description of a service organizations system in a SOC 2 is presented in accordance with description criteria when the description:
-describes the system that the service organization has implemented
-includes information about each description criterion to the extent it is relevant to the system being described
-does not inadvertently or intentionally omit or distort information
A description is not presented in accordance with the description criteria if:
SOC 2
-the description states or implies that certain IT components exist when they do not
-the description states or implies that certain processes and controls have been implemented when they are not being performed
-the description contains statements that cannot be objectively evaluated
The service auditor should consider whether additional disclosures are necessary to supplement the description. Additional disclosures may include:
-significant interpretations made in applying the criteria
-subsequent events
In addition to obtaining evidence that the description presents the system was designed and implemented in accordance with the description criteria, the service auditor must also…
SOC 2
obtain evidence that the controls were suitable designed and operated effectively during the specified period (T2)
Suitably designed controls operated…
SOC 2
as designed by individuals who have the necessary authority and competence to perform the controls
Controls that operate effectively provide…
SOC 2
reasonable assurance of achieving the service organizations service commitments and system requirements based on the applicable trust services criteria
Nature of Test of Controls
The nature and objectives of tests to evaluate the operating effectiveness of controls are different from those performed to evaluate the suitability of design of controls
-make inquiries and perform other procedures such as inspection, observation, or reperformance about how the control was applied
-determine whether the controls to be tested depend on other controls
-evaluate and determine an effective method for selecting the items to be tested
