Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ICS 2 > ICS 4 > Flashcards

ICS 4 Flashcards

1
Q

Soc 1 for Service Org

A

IC over financial reporting - controls @ service org that are likely to be be relevant to user IC over financial reporting

Reports resticted to mgmt of service org, user entity and indepenent auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Soc 2 for Service Or

A

Trust Service Criterai - seucirty, availablity, or processing integrityof a system, or the confidentialty or privacy of inforamation processed by the system. Reports are intended for those who have sufficient knowledge and understading of service org, services provided, and systems used. Mgmt and service auditor should agree on users of report

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Soc 3

A

Trust Services Criteria for General Use Report - controls were effective to provide ressonable assurance that service commitmentsand sytem requirements were achieved based on pplicable trsut services criteria. Report does not include description of system, test of controls or results - for general user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Type 1 Report

A

fairness of the presentation of mgmt description of system and design of controls as a specific date. (Soc 1/2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Type 2 Report

A

fairness of the presentation of mgmt description of system and design and operating effecivness of controls for a period. (Soc 1/2) SOC 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Type 1 report contents

A

MGmt description of system, written assertation by mgmt that description fairly presents system that was deigned/implemented and controls related to control objects state in mgm description were suitably designed to achieved control objectives. - Expressed opinion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Type 2 report contents

A

MGmt description of system, written assertation by mgmt that description fairly presents system that was deigned/implemented and controls related to control objects state in mgm description were suitably designed to achieved control objectives. - Expressed opinion anddescription of test of controls and reuslts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

5 categories of the Trust services

A

CAPPS
Confidentiality
Availablity
Processing Integrity
Privacy
Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Application and Use of trust services

A
  • SOC for cyber security engagement (security, availablity, and control)
  • SOC 2 Engagement -
  • SOC 3 Engagement
    Sutiabilty of design and operating effectivness of controls of an entity over one or more sysyems relevant to trust cateogiries
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

COSO Control Env.

A

Control from prospective of board/mgmt through integirty, ethics, structure, enviornment of accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

COSO Risk Assessment

A

identifying risks, considerations for potential fraud, changes that may impact IC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

COSO Control Activities

A

Control activities implemented and designed to ensure the proper applicationof polices and procedures that help ensure mgmt directives and control objectives are met.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

trust services supplemental crtiera

A

logical/physical access controls, system operations, change management, risk mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

COSO Information and Communication

A

obtaining, gathering, and controlling information and communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

COSO Monitoring

A

conduct ongoing evaluations of control activities and communciate internal control deficiences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Add’l criteria for Availablity

A

ability to ensure systems are continousy available as needed by maintinaingnd monitoring processing cabilities, identifying and responding to threats, and ensuring a recovery planis in place and tested.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Add’l criteria for Processing

A

Consideration related to creating, using, and communicating quality info so objectives will be met regarding product/service specs, controls for completeness and accuracy, productivity, and system specs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Add’l criteria for Confidentiality

A

ensuring confidential info is handled approproiatly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Add’l critieria for Privacy

A

privacy related to collecting personal data, obtaining consent, using only as intended, managing access, discolsing policies to third parties and individuals, maintaining complete and accurate records, monitoring and encofcing practices in place.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When forming an opinion in SOC engagement what should auditor evaluate?

A

sufficiency and appropriatness of evidence, whether uncorrected misstatements, individual or in accurate are material.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

In SOC engagement what is opinion about?

A

subject matter is in accordance with (or based on) the criteria, in all material respects, or the assertion is failry stated in all material respects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Opinion foucses on?

A

Fair presentation of mgmt description of service orgs system, suitabilty of design of controls, effective operation of controls stated (Type 2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SOC Unmodified opinion

A

In all material respects based on the criteria described in management assertation;
1. Mgmt description is fairly presented. SOC2 “in accordance with description criteria”.
2. Controls stated suitabily designed - SOC2 “provide rasonabel assurance that serv. org service commitmenets and system requirements were achieved based on trust services criteria”.
3. Controls operated effectvily (Type 2) - SOC2 - “to provide resonable assurance..”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

SOC and User entity controls

A

If application of complementary user entity controls is necessary to achieve the control objective stated by mgmt, statement to that effect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

When would you modify an opinion

A

When unable to obtain suffiicent appropraite evidence (in all material respects)or subject matter is not in accorance with criteri in all material respects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How is a modified opinion reflected in report

A

descrition of matter or matters giving rise to modification

27
Q

What is taken into consideration when modifying an opinion?

A

nature of the matter, profesional judgement on pervasivness of effects, or possible effects, of the matter on the subject matter of engagement

28
Q

Qualified opinion

A

expect for the effects of the matters, description is presented in accordnace with criteria and controls were suitabliy designed/operating effectivly in all material respects

29
Q

Adverse opinion

A

description misstatements are material and pervasiive, or defencies in designor operationo f contorlsare material and pervasive.

30
Q

Disclaimer

A

do not express an opinion

31
Q

What opinion for scope limination that is matieral but not pervaisum

A

Qualified.

32
Q

What opinion for scoep limination that is mateiral and pervasium

A

Discliamer

33
Q

Key comonents of the report

A
  1. Mgmt description of system
  2. Mgmt assertion
  3. Independent service auditors report
  4. Auditors test of controls and results
34
Q

SOC 1 - content of mgmt descirption

A

sufficient info to allow user auditor to understand how processing affects user entitiy’s FS and to assess risk of material misstatment of user entity’s FS. Common things covered include type of service provided, procedures, system functionality, subervie orgs, controls, info on control env., process to prepare reports, deficiencies in info, compelementary user entity controls, changes to sytem dring period,

35
Q

SOC 2 - content of mgmt descirption

A

descrption of system to allows user entities, business partners, etc., to understand the system and processing and flow of data - prepared to be in accordance with specific criteria and the procedures and controls in placeto mange risk. Types of info include: type of services provided, principal service committments and system reuqirements, compentents of system used, system incidents, applicale trust service criteria, complentary user entity controls, subsevice orgs, irrelevant critiera, details of system control changes.

36
Q

Inclusive method

A

nature of service provided controls with clear deliniation between service organd suborg, portionso of system attibuted to suborg.

37
Q

carve out method

A

doesn’t include contols operate only/primarlyat sub org. but should discuss contorls/criatera to be met by suborg, sub orgs responsibliy, and ndicate that related service committements/system requiremetnsonly achived by suborg contorls are suitable designedand operaing effectivly.

38
Q

Mgmt Assertation (SOC 1/2)

A
  1. Mgmts description of sytesm fairly presents the system that was designed and implemented.
  2. Controls state are suitabily designed
  3. controls stated operated effectivly (type2)
39
Q

Mgmt Assertation (SOC 3)

A

Controls were effective throughout the period to provide resonable assurance that service commitements and system reuirements were achevied baesd on applicable trust service criteria including discrption on boundaries of ystem, service commitments and system requirements were acheived based on he applicable trust services criteria, including boundaries.

40
Q

If mgmt wont provide an asssertaiton

A

auditor required to withdraw when possible under law- or disclaim an opinion

41
Q

SOC 1 CONTENTS

A
  1. Mgmt description - as of specific date (1) or period (2)
  2. Mgmt assertion- key is “meet control objectives”
  3. Audit report - opinion
  4. test of control (type 2)
42
Q

SOC 1 Auditor report - Title

A

Must include “independent”

43
Q

SOC 1 Auditor report - Addressee

A

as reuired by engagement

44
Q

SOC 1 Auditor report - Scope

A

Mgmt description, fuctions system performs, period; critera, services performed by suborg and if carve out or inclusive method, statement that control objectives in description are those mgmt believe are likely to be relevant to user entities IC over financial reporting, wont include those not likely; if need for complementary user controls must include that auditor has not evaluated.

45
Q

SOC 1 Auditor report - Serv. Org responsibilities

A

Reference ot mgmt assertion and stment mgmt responsible for: preparing descirption, assertation, services covered, control objectives, risks that threaten control objecgives, seleting criterai, controls

46
Q

SOC1 Auditors report - Auditor responsiblities

A

Statement abot expressing opinion on fairness of presentation of mgmt description and : conducted in accordanc with attestation standards AICPA, standards reuire plan/performto obtain reaonable assurance…, evidence is sufficent/appropraite for basis of opinion, proceures to btain evidence, assessing risks that descirption is not farily presented, evaluating the overall presntation descirptonin, suitabilty of controls and criteria, esting effecgivess of control (tye 2)

47
Q

SOC 1 Auditors report - test of controls

A

controls tested, if they represent all or a selection of items in population nature of tests, identifeid deviations number tested and numebr deviated, nature of deviations, if IA used to test a description of their work and service auditors procedures related to their work.

48
Q

SOC 1 Auditor report - other matter

A

Type 1 only - did not perform procedures regarding operating effectiness of controls

49
Q

SOC 1 - Auditor report - restricted use

A

the report intended soley for the info/use of mgmt of the service org, user entities and the auditors who audit and report on such user entiteis FS or IC over financial reproting. Should not be used by others.

50
Q

SOC 1 - date of report

A

no earlier thatn th date has obtain sufficeint approprite evidence

51
Q

SOC 2 CONTENTS

A
  1. Mgmt description - as of specific date (1) or period (2)
  2. Mgmt assertion- key is “achieved baesd on applicable trust service criteria”
  3. Audit report - opinion
  4. test of control (type 2)
52
Q

SOC 2 Auditor report - Scope

A

Identification or description of subject matter or assertion being reporting on, sercies/controsl rpovided by suborg and carveout or inclusion, criteria used - description evaluated against description criteria while suitabilty of design and operatinve effectivess of controls evaluated against trust services criteria applicable

53
Q

SOC 2 Auditor report - Serv. Org responsibilities

A

id’s responsible party and resonsibilty for subject matter in accordance with criteria for assertion.

54
Q

SOC2 Auditors report - Auditor responsiblities

A

express an opinion on subject matter assertations, conducted in accordance with AICPA, nature of engagment

55
Q

SOC 2 USERS

A

only for specific parties, identify specified parties,

56
Q

SOC 2 - Test of Controls

A

Descritpion of tests of controls and results - controls that were tested, all or part of population, nature of tests performed, deviations then include # items tested, umebr/natuer of devaitions, causative factors (optional)

57
Q

SOC1 - What is consider a subor

A

services provied are likely relevant to user entites IC over financial reporting, controls at suborg are necessary to achieve mgmt objectives

58
Q

SOC2/3 - What is consider a subor

A

services are relevant to report users understanding of service orgs systems as it relates the applicable trust services criteria- controsl at suborg are necessary to provide resonable assurance that service commitments and system requirements are acheived.

59
Q

When is inclusion method useful

A

services by suborg are extensive, type 1/2 report that meets needs of users is not available for suborg, and info about suborg not reasdily avaiable from other sources

60
Q

when is carve out best?

A

challenges w/ implementing inclusive method- not practical, service auditor not independent from suborg, type 1/2 is avilable, service org cant get suborg to contract/agree to be included.

61
Q

common examples of complementray user entity controls

A

security monitoring, manages service provider environment change, encypited financial data, hysical acces controls, auth. Policies

62
Q

changes to report for qualified opinionSOC !

A

seperae paragraph before opinionthat provides a descritin of the matters giving rise to modification

63
Q

Changes to report for qualified opinion materilal misstatemnt SCO 1

A

Service auditor repsonsibilty - evidence is suffficent/spparote to rpovide basis for qualified opinion.

ICS 2 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions