ISC S4

Question 1

What does a SOC 1, 2, and 3 report examine?

Answer 1

SOC 1: Service organization controls relevant to ICFR
SOC 2: TSC for entities knowledgeable and understanding of SSS
SOC 3: TSC for general use

Question 2

What is the difference between Type I and Type II SOC reports?

Answer 2

Type I: Design of controls at a point in time
Type II: Design of controls over a period of time

Question 3

What are the five TSC and their definitions?

Answer 3

Security - Unauthorized access to systems
Availability - Systems and info available for operations
Processing Integrity - System processing (CVATA)
Confidentiality - Safekeeping of info (broad)
Privacy - Safekeeping of personal info

Question 4

What must a service auditor address in terms of TSC and Additional-Category Specific Criteria ASC?

Answer 4

TSC - All
ASC - All except security

Question 5

What must an entity consider when designing internal controls in terms of TSC?

Answer 5

Set outcomes to meet objectives

Question 6

What is omitted from a SOC Report by the Service Auditor when issuing a Disclaimer of Opinion?

Answer 6

1. Professional standard requirements
2. Obtained sufficient and appropriate audit evidence
3. Description of an examination engagement