SOC 2 criteria › CC3 Risk assessment
SOC 2 CC3.3 explained
The risk assessment considers the potential for fraud.
Typical controls that address CC3.3
- Fraud risk included in the risk assessment
- Segregation of duties for sensitive actions
Evidence auditors usually ask for
- Risk register entries for fraud
- Segregation of duties matrix
Keep CC3.3 evidence organised
Korrali Trust keeps your policies, controls and evidence in one workspace, and reuses them to answer customer security questionnaires.
Other CC3 criteria
Plain-English summary of the 2017 Trust Services Criteria common criteria. Controls and evidence vary by organisation and auditor.