A service organization provides a SOC 2® Type II report covering the period January 1 to December 31. A significant control failure occurred on December 28 and was corrected on January 2. How should this be reflected in the report?

Answer options:

It can be excluded since it happened at the very end of the period.

It should be listed as an exception in the testing results.

It should be reported as a 'Subsequent Event'.

Management can backdate the correction to December 31.

How to approach this question

Determine if the event falls within the examination period.

Full Answer

B.It should be listed as an exception in the testing results.✓ Correct

Since the failure occurred within the specified timeframe, it is a test exception. The fact that it was fixed later does not erase the failure during the period.

Common mistakes

Confusing period events with subsequent events.

Question 31 All questions Question 33

Practice the full CPA ISC Practice Exam 2

82 questions · hints · full answers · grading

More questions from this exam

Q01A service organization provides a cloud-based payroll platform where clients access the software ...Medium Q02An auditor is reviewing the backup strategy for a financial institution that requires a Recovery ...Hard Q03During a walkthrough of the change management process, an auditor observes that developers have w...Medium Q04An auditor is reviewing a SQL query used to generate a list of active customers for a marketing c...Hard Q05Which of the following entities is considered a 'Covered Entity' under the HIPAA Privacy Rule?Medium

View all 82 questions →