SOC Risk and Control Objectives 2

Question 1

Which SOC 2 Trust Services Criterion requires an entity to identify and assess risks that could prevent it from achieving its objectives?

Accepted Answer

CC3.1

Answer

CC3.1 requires management to identify and analyze risks to the achievement of objectives as part of the COSO risk assessment component.

Question 2

In the context of SOC 2 risk assessment, what does 'risk tolerance' refer to?

Accepted Answer

The acceptable level of variation in performance relative to achieving an objective

Answer

Risk tolerance is the acceptable level of variation in performance relative to the achievement of objectives, as defined under COSO principles.

Question 3

A SOC 2 auditor finds that an organization has no formal process for identifying new risks when business objectives change. Which control objective is most directly unmet?

Accepted Answer

Risk identification linked to objective changes

Answer

CC3.1 requires that risk identification processes respond to changes in objectives, making this a direct gap in the risk assessment control objective.

Question 4

Under SOC 1 (SSAE 18), what is the primary purpose of a complementary user entity control (CUEC)?

Accepted Answer

To document controls that user entities must implement for the service organization's controls to be effective

Answer

CUECs identify controls that user entities are responsible for implementing so that the service organization's control objectives are fully achieved.

Question 5

Which of the following best describes a 'residual risk' in a SOC audit context?

Accepted Answer

The risk that remains after controls have been applied

Answer

Residual risk is the remaining level of risk after management has applied controls or other risk responses.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Risk and Control Objectives 2