Appendix B Illustrative Risks and Controls — 19. The illustrative risks and controls presented in this appendix are for illustrative purposes only. They are based on a hypothetical entity in a hypothetical industry. They are not intended to be a comprehensive set of risks and controls or applicable to any particular entity. Criteria Risks Illustrative Controls Criteria Common to All [Security, Availability, Processing Integrity, and Confidentiality] Principles CC1.0 Common Criteria Related to Organization and Management CC1.1 The entity has defined organizational structures, The entity's organizational structure does not The entity evaluates its organizational structure, reporting authorities, and responsibilities provide the necessary information flow to reporting authorities, and responsibilities as for the design, development, implementation, manage [security, availability, processing part of its business planning process and as part operation, monitoring, and maintenance of the integrity, and confidentiality] activities. of its ongoing risk assessment and management system enabling it to meet its commitments and process and revises these when necessary to requirements as they relate to [insert the help meet changing commitments and principle(s) being reported on; for example, requirements. security, availability, processing integrity, and confidentiality]. The roles and responsibilities of key managers Roles and responsibilities are defined in written are not sufficiently defined to permit proper job descriptions and communicated to managers oversight, management, and monitoring of and their supervisors. [security, availability, processing integrity, and confidentiality] activities. Job descriptions are reviewed by entity management on an annual basis for needed changes and where job duty changes are required necessary changes to these job descriptions are also made.
Appendix B — Illustrative Risks and Controls 19. The illustrative risks and controls presented in this appendix are for illustrative purposes only. They are based on a hypothetical entity in a hypothetical industry. They are not intended to be a comprehensive set of risks and controls or applicable to any particular entity. Criteria Risks Illustrative Controls Criteria Common to All [Security, Availability, Processing Integrity, and Confidentiality] Principles CC1.0 Common Criteria Related to Organization and Management CC1.1 The entity has defined organizational structures, reporting authorities, and responsibilities for the design, development, implementation, operation, monitoring, and maintenance of the system enabling it to meet its commitments and requirements as they relate to [insert the principle(s) being reported on; for example, security, availability, processing integrity, and confidentiality]. The entity's organizational structure does not provide the necessary information flow to manage [security, availability, processing integrity, and confidentiality] activities. The entity evaluates its organizational structure, reporting authorities, and responsibilities as part of its business planning process and as part of its ongoing risk assessment and management process and revises these when necessary to help meet changing commitments and requirements. The roles and responsibilities of key managers are not sufficiently defined to permit proper oversight, management, and monitoring of [security, availability, processing integrity, and confidentiality] activities. Roles and responsibilities are defined in written job descriptions and communicated to managers and their supervisors. Job descriptions are reviewed by entity management on an annual basis for needed changes and where job duty changes are required necessary changes to these job descriptions are also made.
AICPA-FINAL-ED-Trust-Services-Principles.docx