CC3.3 Considering fraud risk (COSO principle 8)

The possibility of fraud is taken into account when risks to objectives are assessed. Points of focus: the assessment covers fraudulent reporting, loss of assets and corruption; incentives and pressures are weighed; opportunities for unauthorised acquisition, use or disposal of assets or for altering records are examined; the ways people might rationalise wrongdoing are considered; and IT-specific threats and weaknesses that come with using technology and reaching information are included.

Source: SOC 2 (2017 Trust Services Criteria), CC3.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.