SOC 2 Controls CC3: Risk Assessment

{{snapshot}}

SOC 2 CC3 at a glance

• SOC 2 CC3 is Risk Assessment, spanning four controls, CC3.1–CC3.4.
• CC3.1 sets clear objectives; CC3.2 identifies and analyses risks to them across the entity.
• CC3.3 considers the potential for fraud; CC3.4 assesses changes that could affect internal control.

{{/snapshot}}

CC3.1

SOC 2 CC3.1 requires that your organisation specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

CC3.1 highlights the following points of focus:

Operations Objectives

Reflects Management's Decisions

Your organisation’s operations objectives should accurately reflect management's decisions about structure, industry considerations, and organisation performance.

Considers Tolerance Levels for Risk

Your management team should consider the acceptable levels of variation relative to the attainment of your organisation’s operations objectives.

Includes Operations and Financial Performance Objectives

The organisation should indicate the desired level of operations and financial performance within its operations objectives.

Forms a Basis for Committing of Resources

Management should use your organisation’s operations objectives as a basis for allocating resources needed to achieve desired operations and financial performance.

External Financial Reporting Objectives

Complies With Applicable Accounting Standards

Your organisation’s financial reporting objectives should be consistent with accounting principles suitable and available for the organisation. The accounting principles selected should be pertinent in the circumstances.

Considers Materiality

The management team should consider materiality in financial statement reporting.

Reflects Organisational Activities

External reporting should reflect the underlying transactions and events to show qualitative characteristics and statements.

External Nonfinancial Reporting Objectives

Complies With Externally Recognised Frameworks

The management team should establish objectives consistent with laws and regulations or standards and frameworks of recognised external entities.

Reflects the Necessary Level of Precision

Management should consider the required level of precision and accuracy appropriate for user needs and based on criteria established by third parties in nonfinancial reporting.

Reflects Entity Activities

Your organisation’s external reporting should reflect the underlying transactions and events within a range of acceptable limits.

Internal Reporting Objectives

Reflects Management's Choices

Your organisation’s internal reporting should provide management with accurate and complete information about its choices and the information needed to manage the organisation.

Reflects the Necessary Level of Precision

Management should consider the required level of precision and accuracy appropriate for user needs in nonfinancial reporting objectives and materiality within financial reporting objectives.

Reflects Entity Activities

Your organisation’s internal reporting should reflect the underlying transactions and events within a range of acceptable limits.

Compliance Objectives

Reflects External Laws and Regulations

Laws and regulations determine minimum standards of conduct, which your organisation should integrate into compliance objectives.

Considers Tolerances for Risk

Your management team should consider acceptable levels of variation relative to achieving your organisation’s operations objectives.

An additional point of focus specifically related to all engagements using the trust services criteria:

Establishes Sub-objectives to Support Objectives

The management team should identify sub-objectives related to security, availability, processing integrity, confidentiality, and privacy to support the achievement of your organisation’s objectives related to reporting, operations, and compliance.

CC3.2

SOC 2 CC3.2 requires that your organisation identifies risks to the achievement of its objectives across the entity and analyses risks as a basis for determining how the risks should be managed.

CC3.2 highlights the following points of focus:

Includes Entity, Subsidiary, Division, Operating Unit, and Functional Levels

The organisation should identify and assess risk at multiple levels:

• Organisation

• Subsidiary

• Division

• Operating unit

Relevant to the accomplishment of your objectives.

Analyses Both Internal and External Factors

Your organisation’s risk identification process should consider both internal and external factors and their influence on achieving objectives.

Involves Suitable Levels of Management

The organisation should put effective risk assessment mechanisms in place, involving suitable levels of management.

Assesses Significance of Risks Identified

Your organisation should analyse identified risks through a process that includes assessing the possible significance of the risk.

Defines How to Respond to Risks

Risk assessment should include considering how the risk should best be managed and whether to accept, avoid, reduce, or share the risk.

Additional points of focus specifically related to all engagements using the trust services criteria:

[H3] Identifies and Assesses Criticality of Information Assets and Identifies Threats and Vulnerabilities

Your organisation’s risk identification and assessment procedure should include:

• Recognising information assets. This includes physical devices and systems, virtual devices, software, data and data flows, external information systems and organisational roles

• Evaluating the criticality of the identified information assets

• Recognising the threats to your information assets from intentional (including malicious) and unintentional acts as well as environmental events

• Identifying the possible vulnerabilities of the information assets.

Evaluates Threats and Vulnerabilities From Vendors, Business Partners, and Other Parties

Your organisation’s risk assessment procedure should include analysing potential threats and vulnerabilities from vendors providing goods and services.

The risk assessment procedure should also include the analysis of threats and vulnerabilities that could arise from business partners, customers, and others with access to your organisation’s information systems.

Considers the Significance of the Risk

Consideration of the potential significance of the identified risks should include:

{{snapshot}}

Identifying and analysing risk (CC3.2)

• Identify and assess risk at multiple levels — organisation, subsidiary, division and operating unit — across internal and external factors.
• Recognise information assets, their criticality, and the threats and vulnerabilities against them.
• Evaluate threats from vendors and business partners, then decide whether to accept, avoid, reduce or share each risk.

{{/snapshot}}

CC3.3

SOC 2 CC3.3 requires that your organisation considers the potential for fraud in assessing risks to the achievement of objectives.

CC3.3 highlights the following points of focus:

Considers Numerous Types of Fraud

The organisation’s assessment of fraud should take into account reporting, possible asset loss, and corruption resulting from the various ways that fraud and misconduct can occur.

Assesses Incentives and Pressures

Your organisation’s assessment of fraud risks should consider incentives and pressures.

Assesses Opportunities

The assessment of fraud risk should consider opportunities for:

• Unauthorised possession, use, or disposal of assets

• Altering the entity’s reporting records

• Committing other inappropriate acts.

Evaluates Attitudes and Rationalisations

The organisation’s assessment of fraud risk should consider how management and other personnel might engage in or rationalise improper actions.

Additional point of focus related explicitly to all engagements using the trust services criteria:

Considers the Risks Related to the Use of IT and Access to Information

Your organisation’s assessment of fraud risks should consider threats and vulnerabilities that could occur specifically from the use of IT and access to information.

{{snapshot}}

Building fraud into risk assessment (CC3.3)

• CC3.3 requires considering the potential for fraud — including asset loss, corruption and misstated reporting.
• Assess fraud incentives, pressures, opportunities and rationalisations.
• Include risks arising specifically from the use of IT and access to information.

{{/snapshot}}

CC3.4

SOC 2 CC3.4 requires that your organisation identifies and assesses changes that could significantly impact the internal control system.

CC3.4 highlights the following points of focus:

Considers Changes in the External Environment

Your organisation’s risk identification procedure should consider changes to the regulatory, economic, and physical environment in which the organisation operates.

Considers Changes in the Business Model

The organisation should consider the possible impacts of new business lines, significantly altered arrangements of existing business lines, obtained or divested business operations on the internal control system, rapid growth, changing dependence on foreign geographies, and new technologies.

Considers Changes in Leadership

Your organisation should consider changes in management and corresponding attitudes and philosophies on the internal control system.

An additional point of focus specifically related to all engagements using the trust services criteria:

Considers Shifts in Systems and Technology

Your risk identification process should consider changes arising from changes in your organisation’s systems and the technology environment.

Considers Changes in Vendor and Business Partner Relationships

Your risk identification process should consider potential changes in vendor and business partner relationships.

{{snapshot}}

In Hicomply’s experience

A SOC 2 risk assessment shouldn’t live in a spreadsheet refreshed once a year. Keep a living asset register with threats, likelihood and impact scored against each asset, and you will already have most of what an ISO 27001 risk assessment needs too — score once, treat once, report to both. Our platform tour shows the risk register in action.

{{/snapshot}}