CPA · Question 09 · Area III: SOC Engagements
A service organization is undergoing a SOC 2® Type II engagement. The auditor finds that for a sample of 25 new hires, 2 did not complete the required security awareness training within 30 days of hire as mandated by company policy. The control description states: 'All new hires complete security training within 30 days.' What is the MOST appropriate conclusion?
Answer options:
The control is effective because the majority (92%) complied.
A deviation exists, and the auditor must evaluate if it represents a control deficiency.
The auditor should expand the sample size to 50 to see if the error rate decreases.
Issue an Adverse Opinion immediately.
82 questions · hints · full answers · grading
Expert