Question 1

What evidence do auditors ask for on CC2.2 COSO principle 14: Internally communicates information including objectives and responsibilities?

Accepted Answer

Evidence of internal communication of objectives and of internal control responsibilities, such as policies, briefings and intranet content; Evidence of communication between management and the board, and its frequency; The separate communication channel allowing anonymous or confidential reporting when normal channels are inoperative, and evidence it works; Records of communication with personnel about security responsibilities, incident reporting and changes to controls; Evidence communication reaches contractors and temporary personnel on the same basis.

Question 2

Can CC2.2 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on CC2.2?

Accepted Answer

Policies published to a portal with no evidence anyone read or was directed to them

`CC2.2` COSO principle 14: Internally communicates information including objectives and responsibilities

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet