S4

Question 1

Opinion Issued

Answer 1

• Disclaimer: sufficient and appropriate evidence cannot be obtained (limit scope limitation)
• Adverse: Material and pervasive
• Qualified: Material and not pervasive
• Unmodified: No material deficiencies identified

Question 2

System Infrastructure component

Answer 2

• Obtain understanding of the newly enhanced physical security measures
  -individual physical or virtual resources
• collection of resources that supports a service org’s environment.

Question 3

in determining the method for SOC reporting

Answer 3

The goal:
- management’s description of the service org’s system includes enough info to be useful to intended users of the report.

Question 4

subsequent facts after auditor’s report:

Answer 4

• the service auditor:
  determine whether or not the facts existed at the date of report and relevant enough to be reported to users.

Question 5

Subservice organization

Answer 5

• in a SOC 2/ SOC 3 engagement
• a separate entity that is external to the service org, or it may be a related entity.

Question 6

Complementary user entity controls

Answer 6

• referenced in the opinion section of the SOC 1 report when necessary, with service org controls to meet the stated control objectives.

Question 7

Cybersecurity risk management program

Answer 7

• include: the cybersecurity risk governance structure, risk assessment process, and the monitoring of the cybersecurity risk management program.
• Identify the nature, extent, and timing of system incidents in the service org’s system description.
• Management is not required to include details of control tests performed by the service auditor.

Question 8

SOC reports

Answer 8

• SOC 1 type 2: a written assertation from management that the controls stated in management’s descript of the system were suitably designed and operated effectively throughout the specified period to achieve the control objectives.
• SOC 1 type 1: written assertation from management at a specified date, rather than covering a period of time, and would not include a reference to the operating effectiveness of the controls.
• SOC 2 type 1: written assertion from management at a specified date, rather than covering a specified period of time. An assertion for a SOC 2 type 1 report also references the applicable TSC and would not include a reference to the operating effectiveness of the controls.
• SOC 3: can only be issued as type 2, not type 1.

Question 9

Tests of operating effectiveness

Answer 9

• Type 2 engagement: tests of controls over the operating effectiveness of controls must be performed. These tests would extend to relevant controls of subservice org when the service organization uses the inclusive method to present its services and controls.
• Type 1 engagement: covers the suitability of design and implementation.

Carve-out method: no tests of operating effectiveness of controls in place at the subservice org would be performed as these controls would be excluded from the scope of the engagement.

Question 10

Def of system relevant to SOC 2

Answer 10

• includes the infrastructure, software, procedures, data, and people.