SOC Project Planning & Execution 3 — Questions and Answers
Question 1: A SOC audit project manager uses Earned Value Management (EVM). If EV = $80,000 and AC = $95,000, what does this indicate?
- The project is under budget
- The project is over budget (Correct answer)
- The project is ahead of schedule
- The project has zero cost variance
Correct answer: The project is over budget
A Cost Variance (CV = EV - AC) of -$15,000 means more was spent than the value of work completed, indicating an over-budget condition.
Question 2: Which SOC trust service criteria category is MOST directly addressed by establishing a formal project change control process?
- Availability
- Confidentiality
- Processing Integrity
- Change Management under Common Criteria (CC8) (Correct answer)
Correct answer: Change Management under Common Criteria (CC8)
CC8 (Change Management) under the Common Criteria governs how changes are authorized, tested, and implemented in a controlled manner.
Question 3: What is the PRIMARY purpose of a lessons-learned session at the close of a SOC audit project?
- To assign blame for project failures
- To document insights that improve future engagements (Correct answer)
- To renegotiate the audit fee
- To extend the audit period retroactively
Correct answer: To document insights that improve future engagements
Lessons-learned sessions capture both successes and failures to improve processes, tools, and planning for future audit projects.
Question 4: In project planning for a SOC engagement, 'management's description of the system' must be evaluated for which quality?
- Completeness and accuracy (Correct answer)
- Grammatical clarity and length
- Alignment with GAAP standards
- Approval by external regulators
Correct answer: Completeness and accuracy
The auditor must evaluate whether management's description fairly presents the system as designed and implemented, assessing both completeness and accuracy.
Question 5: A project team building a SOC compliance roadmap uses a work breakdown structure (WBS). What does the WBS primarily provide?
- A visual timeline with milestones
- A hierarchical decomposition of project deliverables into manageable components (Correct answer)
- A budget allocation table by department
- A risk probability and impact matrix
Correct answer: A hierarchical decomposition of project deliverables into manageable components
A WBS decomposes the total project scope into smaller, manageable work packages arranged hierarchically.
Question 6: Which type of dependency exists when Task B cannot start until Task A is 50% complete?
- Finish-to-Start
- Start-to-Start with lead
- Finish-to-Finish
- Start-to-Start with lag (Correct answer)
Correct answer: Start-to-Start with lag
A Start-to-Start relationship with lag allows Task B to begin only after Task A has been underway for a defined period or percentage.
Question 7: For a SOC 1 engagement, what framework do the internal controls being evaluated primarily relate to?
- NIST Cybersecurity Framework
- Internal controls over financial reporting (ICFR) (Correct answer)
- ISO 27001 information security
- COSO Enterprise Risk Management
Correct answer: Internal controls over financial reporting (ICFR)
SOC 1 reports address controls at a service organization that are relevant to user entities' internal control over financial reporting (ICFR).
SOC Project Planning & Execution 3
A SOC audit project manager uses Earned Value Management (EVM).
If EV = $80,000 and AC = $95,000, what does this indicate?