System and Organization Controls (SOC) 2/CC5 Control Activities/22 of 61
CC5.3COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action
Control family: CC5 Control Activities
Control description
The following points of focus, specified in the COSO framework, highlight important characteristics relating to this criterion:
• Establishes Policies and Procedures to Support Deployment of Management’s Directives — Management establishes control activities that are built into business
processes and employees’ day-to-day activities through policies establishing what is expected and relevant procedures specifying actions.
• Establishes Responsibility and Accountability for Executing Policies and Procedures — Management establishes responsibility and accountability for control activ?ities with management (or other designated personnel) of the business unit or function in which the relevant risks reside.
• Performs in a Timely Manner — Responsible personnel perform control activities in a timely manner as defined by the policies and procedures.
• Takes Corrective Action — Responsible personnel investigate and act on matters identified as a result of executing control activities.
• Performs Using Competent Personnel — Competent personnel with sufficient authority perform control activities with diligence and continuing focus.
• Reassesses Policies and Procedures — Management periodically reviews control activities to determine their continued relevance and refreshes them when necessary.