CC3.1 COSO principle 6: Specifies objectives to identify and assess risks
Specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the objectives reflect the service commitments and system requirements made to customers · Policy repository / GRC workspace
- Evidence of management approval of the objectives and of their review during the period · Policy repository / GRC workspace
- Traceability from objectives to the risk assessment, showing risks are assessed against stated objectives · Policy repository / GRC workspace
- Evidence materiality or tolerance levels were considered · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Documented objectives relating to operations, reporting and compliance, specific enough that risks to them can be identified · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Objectives stated so broadly that any risk relates to them and none can be ruled out
- Service commitments in customer contracts never reflected in the internal objectives, so the risk assessment misses what the entity actually promised
- Objectives set once at the start of the programme and unchanged despite significant business change
- Risk assessment performed with no reference to objectives at all, which breaks the link this criterion requires
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC2.3 COSO principle 15: Communicates with external parties regarding matters affecting controls · CC3.2 COSO principle 7: Identifies risks and analyzes to determine how managed