SOC Audit Procedures and Evidence Gathering 2 — Questions and Answers
Question 1: Which sampling method selects every nth item from a population to form a representative sample?
- Random sampling
- Systematic sampling (Correct answer)
- Stratified sampling
- Judgmental sampling
Correct answer: Systematic sampling
Systematic sampling selects items at a fixed interval (every nth item) from the population list.
Question 2: What is 'corroborating evidence' in the context of a SOC audit?
- Evidence that directly proves a control objective
- Additional evidence that supports or confirms other evidence already gathered (Correct answer)
- Evidence obtained from management representations
- Evidence from third-party confirmations only
Correct answer: Additional evidence that supports or confirms other evidence already gathered
Corroborating evidence strengthens audit conclusions by supporting or confirming other evidence already obtained.
Question 3: During a SOC 2 audit, an auditor reviews access logs to verify that only authorized users accessed sensitive data. This procedure is best described as:
- Recalculation
- Reperformance
- Inspection of records (Correct answer)
- Inquiry
Correct answer: Inspection of records
Inspection of records involves reviewing documents, reports, or logs to gather evidence about control operation.
Question 4: What does 'population' mean in the context of audit sampling for SOC engagements?
- The number of auditors on the engagement team
- The complete set of transactions or items from which a sample is drawn (Correct answer)
- The total number of system users
- The set of controls tested during the period
Correct answer: The complete set of transactions or items from which a sample is drawn
The population is the complete collection of items from which the auditor selects a sample for testing.
Question 5: Which audit procedure involves the auditor independently verifying a calculation that management has already performed?
- Confirmation
- Reperformance
- Recalculation (Correct answer)
- Observation
Correct answer: Recalculation
Recalculation involves the auditor independently redoing a mathematical computation to verify its accuracy.
Question 6: In a SOC 1 Type II report, evidence must cover what minimum period?
- At least 1 month
- At least 3 months
- At least 6 months (Correct answer)
- At least 12 months
Correct answer: At least 6 months
AICPA guidance states that a Type II report must cover a minimum period of six months to be meaningful.
Question 7: Which of the following best defines 'audit risk' in the context of SOC engagements?
- The risk that the service organization will lose a client
- The risk that the auditor expresses an incorrect opinion on the description or controls (Correct answer)
- The risk that user entities will misuse the SOC report
- The risk that complementary user entity controls are not documented
Correct answer: The risk that the auditor expresses an incorrect opinion on the description or controls
Audit risk is the risk that the auditor reaches an incorrect conclusion — issuing an unmodified opinion when a material deviation exists.
SOC Audit Procedures and Evidence Gathering 2
Which sampling method selects every nth item from a population to form a representative sample?