Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CPA ISC > Chapter 1 - SOC PLANNING AND PERFORMING > Flashcards

Chapter 1 - SOC PLANNING AND PERFORMING Flashcards

1
Q

What is SOC For Cybersecurity??

A

examination that describes an entity’s cybersecurity risk management program and related controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 5 trust Services categories?

A

Security, Availability, Processing Integrity, Confidentiality, Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why is disclosure important for subsequent events?

A

It is required so users of the report are not misled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Where is the disclosure presented in the Soc report?

A

in the description of the company’s system or management’s assertion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who determines if Disclosure is needed if there’s a subsequent event? What should Auditor do?

A

The auditor should request that management evaluate the breach and determine if a disclosure is needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who are the intended users of a Soc 1

A

User auditor, user entities, and service org management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does NIST Cybersecurity Framework Profile do?

A

Identifies the outcome a company has prioritized to remediate control gaps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What method does the Subcompany have to provide a Management representation letter? What do they both contain?

A

inclusive not carved out & description of sub companies services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What opinion should you give if management refuses to provide a written representation letter?

A

– Provide a modified opinion because of a scope of limitation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are you called if a company retains responsibility for controls and monitors you?

A

A vendor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What should an auditor do if a subsequent event becomes known?

A

Perform additional procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is used to measure of evaluate managements description of the system?

A

Aicpa dc section 200 description criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is used to measure of evaluate managements description of the system?

A

Aicpa dc section 200 description criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What criteria is used to prove controls were designed, implemented, and operated to provide assurance ?

A

Aicpa TSP section 100 trust services criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How does an auditor determine materiality?

A

-Misstatements
-qualitative and quantitative factors
-the circumstances, nature, size, and extent of misstatements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What forms the basis for the auditors opinion of the systems description, control design, and control effectiveness?

A

Managements written representation

17
Q

When is it okay to give a disclaimer of opinion? What do others get if not pervasive?

A

Scope limitation if material and pervasive, if not its a qualified opinion

18
Q

What phase does the auditor obtain a signed management rep letter?

A

Reporting

19
Q

What does the management description cover under the Inclusive METHOD?

A

Sub services org controls objectives and related controls

20
Q

What should you do regard events after the examination period but before the auditors report date in Soc 2 engagement?

A

include disclosure in the description or managements assertion so people aren’t misled.

21
Q

who are the intended users of a Soc 1 report? purpose?

A

User entities, company management, user auditors

The purpose is to assure controls relevant to user entities’ Internal control over Financial reporting

22
Q

who are the intended users of a Soc 2 report? purpose?

A

management and parties who have a direct relationship with the org and knowledge and understanding of the system

Purpose- assure controls relevant to security, availability, processing integrity, confidentiality, or privacy.

23
Q

who does the audit have to be independent of in a Soc engagement?

A

The company, Subcompany if the inclusive method is used

not user entity!

24
Q

What is included in management’s description if the Carve out method is used?

A

must explicitly state that the description does not extend to complementary sub-company controls (CSOCs

25
Q

What is included in management’s description if the Inclusion method is used?

A

explicitly state that procedures were also performed on the sub- company’s system description and controls.

26
Q

Who is responsible for defining the scope of the audit engagement? What is included in the audits scope?

A

The company is

Systems and services

27
Q

What opinion would you give for a scope limitation if it was material but not pervasive? What if it was pervasive?

A

Qualified opinion

Disclaimer of opinion

28
Q

Where does management describe Complementary user entity controls?

A

Description of the company’s system

29
Q

How does the audit determine his report date?

A

the date on which the service auditor has
1. completed audit procedures
2. received management’s finalized description, assertion
3. signed representation letter.

30
Q

What is a sub-company considered under the inclusive method? What must they prepare? Where is it located?

A

a Responsible party, Written assertion, directly behind the company’s assertion letter.

31
Q

What would an auditor inspect if evaluating confidentiality to obtain an understanding of the effectiveness of any system’s internal controls?

A

policies and procedures

32
Q

What is the most expensive test of a disaster recovery plan?

A

Preparedness test

  • Each office/area will be tested to ensure that the disaster plan is adequate.
33
Q

What type of development bridges the gap between business impact analysis and continuity planning?

A

Strategy Development

by analyzing and prioritizing the risks brought forward during the business impact analysis.

34
Q

What ensures effective functioning of the system and mitigating associated risks?

A

Segregation of duties

35
Q

What is the auditors primary responsibility related to a subcompany?

A

Access the suitability of the companies controls for achieving specific goals tied to the service they provide to the user entity.

36
Q

The number of deviations is an example of what type of materiality factor

A

QUANTITATIVE

Surround issues that are numerical

37
Q

The presence of distortion or omission is an example of what type of materiality factor?

A

qualitative

involves the quality of information presented

38
Q

What should you do if you want to obtain an understanding of how a company communicates incident reporting information to a carved-out sub-company?

A

Review the company’s contractual agreement with the sub-company

  • inspect the contract, SLA, or SOC 2 REPORT to understand the services.
39
Q

how should the auditor identify the boundaries of a system?

A

a risk assessment and compare it to management description of the system

CPA ISC (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions