ExpertMedium1 markMultiple Choice
CPA · Question 63 · Area III: SOC Engagements
An auditor is reviewing the 'System Description' for a SOC 2® report. The description lists 'Google Cloud Platform' as a subservice organization. The auditor notes that the description does NOT include the specific controls performed by Google. This indicates:
An auditor is reviewing the 'System Description' for a SOC 2® report. The description lists 'Google Cloud Platform' as a subservice organization. The auditor notes that the description does NOT include the specific controls performed by Google. This indicates:
Answer options:
A.
The carve-out method is being used.
B.
The inclusive method is being used.
C.
The report is incomplete and should be rejected.
D.
Google is not a subservice organization.
How to approach this question
No controls listed = Carve-out. Controls listed = Inclusive.
Full Answer
A.The carve-out method is being used.✓ Correct
A
In the carve-out method, the nature of the services provided by the subservice organization is described, but their specific control objectives and controls are excluded from the system description and the auditor's testing.
Common mistakes
Thinking omission is an error.
Practice the full CPA ISC Practice Exam
82 questions · hints · full answers · grading
More questions from this exam
Q01A CPA is performing a risk assessment for a client that uses a public cloud provider for its core...HardQ02During a walkthrough of a client's change management process, the auditor notes that developers h...HardQ03A service organization provides a real-time transaction processing platform. The service level ag...HardQ04An auditor is reviewing a SQL query used by the finance team to generate a report of all sales tr...HardQ05A healthcare clearinghouse is preparing for a SOC 2® engagement. They utilize a private cloud dep...Hard