Do the tests of operating Does the description Page # in the service effectiveness and Reference from of the controls and organization’s results of those tests Section the control objectives description of its support the VII to complementary Control objective as enable the plan system or service achievement of the user entity controls listed in the auditor to evaluate auditor’s of stated control identified in the description (from the design and controls where objective? (Yes/No) description that are in Section VI) confirm the control objective is Note: Consider the place to support the implementation of listed (from Section effect of any plan auditor’s risk relevant controls and VI) deviations identified assessment assess risk? (Yes/No) in the above in Section VI IT General Controls/Control Objectives Logical Access and Program Change Management – Controls/Control Objectives Related to New Plan Set-up Plan Provisions – Controls/Control Objectives Related to New Plan Set-up Participant Level Data/Accounts and Investments – Controls/Control Objectives Related to Eligibility, Enrollment and Participant Data Controls/Control Objectives Related to Contributions Plan – Controls/Control Objectives Related to Contributions Participant Level – Controls/Control Objectives Related to Participant Account Income/Expense Allocations Controls/Control Objectives Related to Distributions to Participants/Beneficiaries Controls/Control Objectives Related to Distributions - Plan Expenses Controls/Control Objectives Related to Marketable Securities Held Safekeeping & Valuation – Controls/Control Objectives Related to Non-readily Marketable Securities Held Safekeeping & Valuation – Evaluation of the Control Objectives Continued
Page # in the service organization’s description of its system or service auditor’s of controls where control objective is listed (from Section VI) Control objective as listed in the description (from Section VI) Does the description of the controls and the control objectives enable the plan auditor to evaluate the design and confirm the implementation of relevant controls and assess risk? (Yes/No) Do the tests of operating effectiveness and results of those tests support the achievement of the stated control objective? (Yes/No) Note: Consider the effect of any deviations identified in the above in Section VI Reference from Section VII to complementary user entity controls identified in the description that are in place to support the plan auditor’s risk assessment IT General Controls/Control Objectives – Logical Access and Program Change Management Controls/Control Objectives Related to New Plan Set-up – Plan Provisions Controls/Control Objectives Related to New Plan Set-up – Participant Level Data/Accounts and Investments Controls/Control Objectives Related to Eligibility, Enrollment and Participant Data Controls/Control Objectives Related to Contributions – Plan Controls/Control Objectives Related to Contributions – Participant Level Controls/Control Objectives Related to Participant Account Income/Expense Allocations Controls/Control Objectives Related to Distributions to Participants/Beneficiaries Controls/Control Objectives Related to Distributions - Plan Expenses Controls/Control Objectives Related to Marketable Securities Held – Safekeeping & Valuation Controls/Control Objectives Related to Non-readily Marketable Securities Held – Safekeeping & Valuation Evaluation of the Control Objectives Continued
soc1-type-2-report-documentation-tool.docx