CC1.3 COSO principle 3: Management establishes structures, reporting lines, and authorities
Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Organisational charts showing structures and reporting lines in the period, with evidence of board oversight of that structure · Cloud console / configuration management
- Evidence of review of the structure after change, such as reorganisation, acquisition or significant growth · Cloud console / configuration management
- Evidence responsibilities for outsourced functions are defined and assigned to an internal owner · Vendor register / contract repository
governing documentDocuments that govern the control
- Documented authorities and responsibilities, including delegation of authority limits and who may approve what · Policy repository / GRC workspace
- Job descriptions for roles with internal control or security responsibility · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Organisation chart current for the audit while the period contained an unrecorded restructure
- Delegation of authority undocumented, so approvals cannot be tested against a defined limit
- Outsourced functions treated as the vendor's responsibility with no named internal owner
- Security responsibility assigned to a role that has no authority over the systems concerned
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC1.2 COSO principle 2: Board exercises oversight responsibility · CC1.4 COSO principle 4: Demonstrates commitment to attract and retain competent individuals