Tag: Control Matrices

SOC Planning – Controls Risk Assessment

There are various planning steps that occur at the onset of a System and Organization Controls (SOC) 1 and/or 2 engagement, most of them the client isn’t aware is happening in the background. These steps are generally included in the audit program with templates available to complete some of the steps.

The controls risk assessment is a planning step that can begin once the control matrices are received from the client. This is when the fun begins. The SOC controls risk assessment is different from what would normally be included in a NIST-based risk assessment, which looks at risks from a confidentiality, integrity, and availability perspective, and assesses those risks based on impact and likelihood.

The SOC control risk assessment analyzes the design of controls to ensure they adequately meet the control objective or trust service criteria (TSC), the significance of the controls as they related to the objective/criteria, and the risk of non-compliance for each control.

Example SOC 1 control matrices for an access control objective. This is not a fully fleshed out objective and is just being used for illustrative purposes.

Control Design

The primary goal when reviewing the controls is to determine whether the sum of the controls adequately support the control objective or TSC.

This is a wholesale review of the controls to ensure they meet the minimum requirements of the control objective. Although not ideal, there are situations in which a single control is enough to meet the controls objective. It’s also possible for there to be 10+ controls and still miss a key aspect of the control objective.

Using the example control matrices above, if this were a very large organization, I’d inquire about controls to update access for employees that transfer from one business unit (BU) or department to another BU or department. This is a potential area for there to be a design deficiency.

There’s a lot of grey area in this review that requires professional judgement that comes from working with clients both big and small, more and less complex. The audit firm should be cautious about starting the engagement before clearing up any potential design deficiencies.

Control Significance

The control significance assessment determines the significance of the control as it relates to the control objective. Each control is assessed a rating of high, moderate, or low based on its significance. A high control significance would indicate the control has a direct correlation to the control objective. A moderate control significance would indicate a supporting control. A low control significance would indicate limited or no correlation to the control.

At a minimum, there needs to be at least 1 control with high control significance per objective/criteria. Otherwise, there would be a design deficiency.

In my experience, policies and procedures would be assessed as low control significance, assuming the control objective doesn’t directly call out for policies and procedures. This isn’t to say policies and procedures aren’t an important aspect of the overall control environment, just that they’re not directly related to meeting the objective/criteria as stated. Monitoring controls (e.g. periodic review) would be assessed as moderate control significance. These controls are detective controls rather than preventive controls.

Risk of Non-Compliance

Each control is then assessed a rating of high or low based on the risk that testing would result in an exception or finding. This assessment is pretty straightforward. Controls are typically assessed as low risk of non-compliance unless one of the following criteria are met:

  • First Year Engagement: All controls are assessed a high risk of non-compliance.
  • Subsequent Year Engagement: Control assessed a high risk of non-compliance if exceptions or findings were noted in the prior year.
  • Other: Although less frequent, if exceptions were noted during other internal control assessments, the control could also be assessed as a high risk of non-compliance. These might be found on a corrective action plan (CAP) reports provided during planning.
Example completed risk assessment using the access control matrices in the image above.

Why

Now, you might ask, what’s the purpose of going through this process? There are 2 primary reasons:

  1. Completeness: Ensure the controls are complete and there are no design deficiencies that would result a qualified opinion.
  2. Sampling: Control significance and risk of non-compliance are used as a basis for determining testing sample sizes.

The completed risk assessment is documented in the audit workpapers and isn’t usually provided to the client. However, in some situations, the client might request the results of the risk assessment in what would be referred to as a test plan. The test plan would include the risk assessment along with a tentative plan for how each control will be tested. This request is more common with government clients.

Not all firms use the same audit methodology as noted above. However, it’s important for service organizations to understand what goes into each of the steps of an engagement prior to contracting with a service auditor. The best time to do this is during the request for services and proposal process, at which point the service auditor should provide a general audit methodology used to complete the engagement.