System and Organization Controls (SOC) 2/CC1 Control Environment/8 of 61
CC1.3COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives
Control family: CC1 Control Environment
Control description
The following points of focus highlight important characteristics relating to this criterion: Points of focus specified in the COSO framework:
• Considers All Structures of the Entity — Management and the board of directors consider the multiple structures used (including operating units, legal entities, geo?graphic distribution, and outsourced service providers) to support the achievement of objectives.
• Establishes Reporting Lines — Management designs and evaluates lines of reporting for each entity structure to enable execution of authorities and responsibilities
and flow of information to manage the activities of the entity.
• Defines, Assigns, and Limits Authorities and Responsibilities — Management and the board of directors delegate authority, define responsibilities, and use appropriate
processes and technology to assign responsibility and segregate duties as necessary at the various levels of the organization.