System and Organization Controls (SOC) 2/CC3 Risk Assessment/17 of 61
CC3.4COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control
Control family: CC3 Risk Assessment
Control description
The following points of focus highlight important characteristics relating to this criterion: Points of focus specified in the COSO framework:
• Assesses Changes in the External Environment — The risk identification process considers changes to the regulatory, economic, and physical environment in which the entity operates.
• Assesses Changes in the Business Model — The entity considers the potential impacts of new business lines, dramatically altered compositions of existing business lines, acquired or divested business operations on the system of internal control, rapid growth, changing reliance on foreign geographies, and new technologies.
• Assesses Changes in Leadership — The entity considers changes in management and respective attitudes and philosophies on the system of internal control.