SOC2-CC3.3 CC3.3 Considering fraud risk (COSO principle 8)
SOC2-CC3.3 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC3.3 Considering fraud risk (COSO principle 8). The possibility of fraud is taken into account when risks to objectives are assessed. Points of focus: the assessment covers fraudulent reporting, loss of assets and corruption; incentives and pressures are weighed; opportunities for unauthorised acquisition, use or disposal of assets or for altering records are examined; the ways people might rationalise wrongdoing are considered; and IT-specific threats and weaknesses that come with using technology and reaching information are included.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
NIST SP 800-53 Rev 5
- NIST800-PM-12 PM-12 Insider Threat Program (closest match)
- NIST800-RA-3 RA-3 Risk Assessment (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records