SOC Risk and Control Objectives 5

Question 1

Which COSO principle requires management to identify and assess changes that could significantly affect the system of internal control?

Accepted Answer

Principle 11 — Identifies and Analyzes Significant Change

Answer

COSO Principle 11 specifically requires the organization to identify and assess changes in the business environment, business model, or leadership that could affect internal controls.

Question 2

A SOC 2 report covering the confidentiality category would most directly address which control objective?

Accepted Answer

Protecting information designated as confidential from unauthorized disclosure

Answer

The confidentiality category requires controls that protect information designated as confidential from unauthorized disclosure throughout its lifecycle.

Question 3

When a service organization uses the inclusive method for subservice organizations in a SOC report, what is the result?

Accepted Answer

The subservice organization's controls are included in the description and tested by the service auditor

Answer

Under the inclusive method, the subservice organization's services and controls are included in the service organization's system description and are tested by the service auditor.

Question 4

Which control activity is most effective at detecting unauthorized changes to production systems?

Accepted Answer

File integrity monitoring and change detection alerts

Answer

File integrity monitoring continuously compares current system states against baselines and alerts on unauthorized modifications, making it the most direct detective control for production changes.

Question 5

In a SOC 2 engagement, which party issues the opinion on whether the controls are suitably designed and operating effectively?

Accepted Answer

The independent service auditor (CPA firm)

Answer

The independent CPA firm acting as service auditor examines the controls and issues the opinion on design suitability and operating effectiveness.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Risk and Control Objectives 5