System and Organization Controls (SOC) 2/CC5 Control Activities/20 of 61
CC5.1COSO Principle 10: The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels
Control family: CC5 Control Activities
Control description
The following points of focus, specified in the COSO framework, highlight important characteristics relating to this criterion:
• Integrates With Risk Assessment — Control activities help ensure that risk responses that address and mitigate risks are carried out.
• Considers Entity-Specific Factors — Management considers how the environment, complexity, nature, and scope of its operations, as well as the specific characteris?tics of its organization, affect the selection and development of control activities.
• Determines Relevant Business Processes — Management determines which relevant business processes require control activities.
• Evaluates a Mix of Control Activity Types — Control activities include a range and variety of controls and may include a balance of approaches to mitigate risks, considering both manual and automated controls, and preventive and detective controls.
• Considers at What Level Activities Are Applied — Management considers control activities at various levels in the entity.
• Addresses Segregation of Duties — Management segregates incompatible duties and, where such segregation is not practical, management selects and develops alternative control activities.