Compliancemanzill.com
System and Organization Controls (SOC) 2

System and Organization Controls (SOC) 2/CC1 Control Environment/10 of 61

CC1.5COSO Principle 5: The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives

Control family: CC1 Control Environment

Control description

The following points of focus highlight important characteristics relating to this criterion:

Points of focus specified in the COSO framework:

• Enforces Accountability Through Structures, Authorities, and Responsibilities —

Management and the board of directors establish the mechanisms to communicate and hold individuals accountable for performance of internal control responsibilities across the entity and implement corrective action as necessary.

• Establishes Performance Measures, Incentives, and Rewards — Management and the board of directors establish performance measures, incentives, and other rewards appropriate for responsibilities at all levels of the entity, reflecting appropriate dimensions of performance and expected standards of conduct, and considering the achievement of both short-term and longer-term objectives.

• Evaluates Performance Measures, Incentives, and Rewards for Ongoing Relevance— Management and the board of directors align incentives and rewards with the fulfillment of internal control responsibilities in the achievement of objectives.

• Considers Excessive Pressures — Management and the board of directors evaluate and adjust pressures associated with the achievement of objectives as they assign re?sponsibilities, develop performance measures, and evaluate performance.

• Evaluates Performance and Rewards or Disciplines Individuals — Management and the board of directors evaluate performance of internal control responsibilities, including adherence to standards of conduct and expected levels of competence, and provide rewards or exercise disciplinary action, as appropriate.

How to implement

Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.