A security control assessment compares evidence with defined requirements. Findings depend on the system boundary, relevant risks, responsible personnel, and the date or period examined.
System and Organization Controls (SOC) is the reporting family that includes SOC 2 examinations of service organization controls. The service auditor evaluates security controls against applicable Trust Services Criteria, considering the organization's service commitments and system requirements.
The assessment distinguishes three sources of expectations.
- Service commitments: Promises made to customers or other relevant parties, such as preparing everyone with system access to recognize security threats.
- System requirements: Specifications needed to fulfill those commitments, such as completing appropriate security training before access begins.
- Trust Services Criteria: Evaluation criteria addressing organizational controls, including security responsibilities, communication, risk assessment, access protection, and monitoring.
Security's common criteria underpin every SOC 2 engagement. Additional categories depend on scope, commitments, and requirements; a security assessment does not automatically examine every confidentiality or privacy obligation.
A training policy translates these expectations into assigned activities. The auditor must detect deficiencies in the suitability of the design even when personnel faithfully follow a policy that omits a...
Common mistakes
- Wrong comparison point. Comparing Omar only with an employee-only policy misses the broader requirement covering everyone with system access.
- Tester position confused. An outside consultant working from an internal foothold performs internal testing, regardless of the consultant's employer.
- Technical result overextended. A clean scan supplies no evidence that an onboarding coordinator checked training completion.
Bottom line
- Security findings compare evidence with service commitments, system requirements, applicable criteria, and the policy effective during the tested period.
- Design, implementation, and operating effectiveness require distinct conclusions supported by appropriate evidence.
- Awareness assessment considers audience coverage, role-specific instruction, leadership behavior, delivery, and demonstrated understanding.
- A walkthrough traces actual performance through the process without independently establishing operation throughout a period.
Exam shortcut
Identify the required population and timing first. Compare the policy with the broader commitment before deciding whether a person violated that policy. Hold the facts constant when a question changes one clause. Adding contractors to an otherwise suitable training requirement changes how the same omitted check is classified. Read the testing verb: identify weaknesses suggests scanning; attempt exploitation suggests penetration testing; independently repeat a procedure suggests reperformance.
The full lesson (about 4,132 words, 28 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.B3
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.