SOC Audit Procedures and Evidence Gathering 3

Question 1

What is the primary purpose of an auditor obtaining a management representation letter in a SOC engagement?

Accepted Answer

To obtain written confirmation of management's assertions and disclosures made during the audit

Answer

A management representation letter is written evidence confirming statements management made verbally during the engagement.

Question 2

When an auditor traces a transaction from its origination through the system to the final record, this technique is called:

Accepted Answer

Tracing

Answer

Tracing follows a transaction forward from source documents through the system to ensure completeness of recording.

Question 3

What is 'vouching' as an audit procedure in a SOC engagement?

Accepted Answer

Selecting a recorded item and tracing it back to its source document to verify occurrence

Answer

Vouching selects a recorded transaction and traces it back to supporting documents to confirm it actually occurred.

Question 4

Which of the following is a characteristic of 'sufficient' audit evidence under attestation standards?

Accepted Answer

There is enough of it to support the auditor's conclusion

Answer

Sufficiency refers to the quantity of evidence — enough must be gathered to support the auditor's conclusion.

Question 5

An auditor discovers that change management logs for a cloud service provider are incomplete for two months of a six-month review period. What should the auditor do first?

Accepted Answer

Inquire with management about the gap and seek alternative evidence

Answer

The auditor should first inquire with management and seek alternative evidence before concluding on the impact of the gap.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Audit Procedures and Evidence Gathering 3