CC1.2 COSO principle 2: Board exercises oversight responsibility
The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Reporting pack provided to the board, including security metrics, risk reporting and incident summaries · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Membership records evidencing independence from management, and the skills or expertise relevant to security and technology · Cloud console / configuration management
- Minutes of board or committee meetings in the period showing internal control and security matters were presented and challenged · Cloud console / configuration management
- Evidence of board decisions or direction resulting from that oversight · Cloud console / configuration management
governing documentDocuments that govern the control
- Board or equivalent governing body charter defining its oversight responsibilities over internal control · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Cloud console / configuration management on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- A board exists on paper for a smaller entity, with no meetings, no minutes and therefore no oversight to evidence
- Minutes recording that a security update was given, with no indication of what was said or what the board concluded
- Independence asserted while every member is an executive of the entity or its investor with a management role
- Security reporting reaching management only, never the governing body
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC1.1 COSO principle 1: Demonstrates commitment to integrity and ethical values · CC1.3 COSO principle 3: Management establishes structures, reporting lines, and authorities