SOC Reporting Frameworks and Standards 3

Question 1

Under the carve-out method for subservice organizations in a SOC report, the service auditor:

Accepted Answer

Excludes subservice organization controls from the scope and notes their existence

Answer

Under the carve-out method, the service auditor excludes the subservice organization's controls from the scope of the engagement, only describing their existence.

Question 2

The SOC for Cybersecurity report is based on which criteria developed by the AICPA?

Accepted Answer

Cybersecurity Risk Management Reporting Framework

Answer

The SOC for Cybersecurity engagement uses the AICPA's Cybersecurity Risk Management Reporting Framework as the criteria for evaluating an entity's cybersecurity risk management program.

Question 3

Which of the following best describes a 'qualified' opinion in a SOC report?

Accepted Answer

The auditor found material exceptions in one or more control areas

Answer

A qualified opinion indicates that, except for noted exceptions or deviations, the controls are suitably designed and/or operating effectively.

Question 4

Which Trust Services Criteria category is MANDATORY for every SOC 2 engagement?

Accepted Answer

Security (Common Criteria)

Answer

Security, defined using the Common Criteria, is the only required category in a SOC 2 engagement; all other categories are optional based on the service commitments.

Question 5

A SOC 3 report differs from a SOC 2 report primarily because the SOC 3:

Accepted Answer

Can be freely distributed to the public without restriction

Answer

SOC 3 reports are general-use reports that can be freely distributed and posted publicly, unlike restricted-use SOC 2 reports.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Reporting Frameworks and Standards 3