SOC Risk Assessment & Management 2

Question 1

In a SOC 2 engagement, which risk assessment component focuses on how management identifies risks that could prevent the entity from achieving its service commitments?

Accepted Answer

Risk identification

Answer

Risk identification is the process by which management recognizes risks that could prevent achievement of service commitments and system requirements.

Question 2

A service organization outsources its data backup to a subservice provider. Under the carve-out method in a SOC 1 report, how are the subservice organization's controls treated?

Accepted Answer

They are excluded from the scope and description

Answer

Under the carve-out method, the subservice organization's controls are excluded from the service organization's description and from the scope of the auditor's examination.

Question 3

Which qualitative risk analysis technique assigns risks to categories such as High, Medium, or Low based on likelihood and impact?

Accepted Answer

Risk matrix (heat map)

Answer

A risk matrix or heat map plots likelihood against impact to assign qualitative ratings of High, Medium, or Low.

Question 4

Under COSO ERM, 'risk appetite' is best described as:

Accepted Answer

The amount of risk an entity is willing to accept in pursuit of value

Answer

COSO ERM defines risk appetite as the amount of risk, on a broad level, an entity is willing to accept in pursuit of value.

Question 5

A SOC 2 auditor identifies that a service organization has no formal process for updating its risk register when new services are launched. Which Trust Services Criteria principle does this most directly impact?

Accepted Answer

Common Criteria – CC3 (Risk Assessment)

Answer

CC3 covers risk assessment requirements, including identifying and analyzing risks when changes to the environment occur, such as launching new services.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Risk Assessment & Management 2