Chapter 11 — Supervised laboratory

Chapter 11 — Supervised laboratory

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 The task"]
  N2["11.2 Reading critically"]
  N3["11.3 Findings"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 The task"]
  N2["11.2 Reading critically"]
  N3["11.3 Findings"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 The task]
    |
    v
[11.2 Reading critically]
    |
    v
[11.3 Findings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) carry out a supervised assurance review of a synthetic supplier; (2) read an assurance report critically; (3) record findings.

11.1 The task

In the supervised laboratory, Lena reviews a synthetic SOC 2 type two report from a fictional card processing supplier. Mr. Reyes asks her to determine whether the report covers the services Marston uses, whether the period is current, what exceptions were noted and which complementary controls Marston must operate itself. She uses a checklist based on the AICPA trust services criteria categories, without treating the synthetic report as a real attestation. Mr. Reyes adds that each of these questions changes how much Marston can rely on the report, so none can be skipped.

11.2 Reading critically

Lena finds the report covers the card processing service but excludes the fraud monitoring module Marston also uses. The period ended nine months ago. Two exceptions appear: delayed removal of leavers' access and one missed quarterly vulnerability scan. The report lists complementary user entity controls, including that Marston must review its own users' access to the supplier's portal. She notes that Marston has never done this review. That missing portal review is a complementary user entity control, so the gap sits with Marston rather than with the supplier.

11.3 Findings

Lena records findings: the fraud module is outside the report's scope, so separate assurance is needed; the period is ageing, so a bridge letter should be requested; the two exceptions need follow-up with the supplier; and Marston must start reviewing its own portal users. Mr. Reyes confirms her analysis and notes that complementary controls are often missed because organisations assume the supplier handles everything. Each of these four items is then logged in her findings workflow with an owner, a severity and a target date.

Worked example

Lena reviews a synthetic SOC 2 report, finds a scope gap, an ageing period, two exceptions and an unperformed complementary control.

Synthetic case. The report and supplier are synthetic; AICPA trust services criteria are real; this is not an attestation.

Errors and limits

Reports have limited scope. Bridge letters give limited assurance.

Exercises

• EX051 — Scope gap. What was outside the report's scope? Rubric: 3 = the fraud monitoring module;; 2 = fraud module;; 1 = vague;; 0 = none.
• EX052 — Ageing period. Why request a bridge letter? Rubric: 3 = the report period ended nine months ago;; 2 = ageing;; 1 = vague;; 0 = none.
• EX053 — Exceptions. Which two exceptions did the report note? Rubric: 3 = delayed leaver removal and a missed vulnerability scan;; 2 = two;; 1 = vague;; 0 = none.
• EX054 — Complementary control. Which complementary control had Marston never performed? Rubric: 3 = reviewing its own users' access to the supplier portal;; 2 = portal review;; 1 = vague;; 0 = none.
• EX055 — Common mistake. Why are complementary controls often missed? Rubric: 3 = organisations assume the supplier handles everything;; 2 = assumption;; 1 = vague;; 0 = none.

Synthesis

Critical reading of assurance reports finds scope gaps, exceptions and duties left with the customer.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →