Compliancemanzill.com
System and Organization Controls (SOC) 2

System and Organization Controls (SOC) 2/CC3 Risk Assessment/14 of 61

CC3.1COSO Principle 6: The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives

Control family: CC3 Risk Assessment

Control description

The following points of focus highlight important characteristics relating to this criterion:

Points of focus specified in the COSO framework:

Operations Objectives

• Reflects Management's Choices — Operations objectives reflect management's choices about structure, industry considerations, and performance of the entity.

• Considers Tolerances for Risk — Management considers the acceptable levels of variation relative to the achievement of operations objectives.

• Includes Operations and Financial Performance Goals — The organization reflects the desired level of operations and financial performance for the entity within operations objectives.

• Forms a Basis for Committing of Resources — Management uses operations objectives as a basis for allocating resources needed to attain desired operations and perations Objectivesfinancial performance.

External Financial Reporting Objectives

• Complies With Applicable Accounting Standards — Financial reporting objectives are consistent with accounting principles suitable and available for that entity. The accounting principles selected are appropriate in the circumstances.

• Considers Materiality — Management considers materiality in financial statement presentation.

• Reflects Entity Activities — External reporting reflects the underlying transactions and events to show qualitative characteristics and assertions.

External Nonfinancial Reporting Objectives

• Complies With Externally Established Frameworks — Management establishes ob?jectives consistent with laws and regulations or standards and frameworks of recognized external organizations.

• Considers the Required Level of Precision — Management reflects the required level of precision and accuracy suitable for user needs and based on criteria established by third parties in nonfinancial reporting.

• Reflects Entity Activities — External reporting reflects the underlying transactions and events within a range of acceptable limits.

Internal Reporting Objectives

• Reflects Management's Choices — Internal reporting provides management with accurate and complete information regarding management's choices and information needed in managing the entity.

• Considers the Required Level of Precision — Management reflects the required level of precision and accuracy suitable for user needs in nonfinancial reporting objectives and materiality within financial reporting objectives.

• Reflects Entity Activities — Internal reporting reflects the underlying transactions and events within a range of acceptable limits Compliance Objectives

• Reflects External Laws and Regulations — Laws and regulations establish minimum standards of conduct, which the entity integrates into compliance objectives.

• Considers Tolerances for Risk — Management considers the acceptable levels of variation relative to the achievement of operations objectives.

How to implement

Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.