SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC3.3: CC3.3 Considering fraud risk (COSO principle 8)
SOC 2 SOC2-CC3.3 covers CC3.3 Considering fraud risk (COSO principle 8). The held text names 4 evidence records for it, the first being Fraud risk assessment or fraud section of the enterprise risk assessment. The common gap an assessor flags is Risk assessment has no fraud component.
The possibility of fraud is taken into account when risks to objectives are assessed. Points of focus: the assessment covers fraudulent reporting, loss of assets and corruption; incentives and pressures are weighed; opportunities for unauthorised acquisition, use or disposal of assets or for altering records are examined; the ways people might rationalise wrongdoing are considered; and IT-specific threats and weaknesses that come with using technology and reaching information are included.
What evidence supports SOC2-CC3.3?
- Fraud riskFraud risk assessment or fraud section of the enterprise risk assessment
- Fraud riskAnalysis of privileged access and data misuse scenarios
- Fraud riskAnti-fraud policy and reporting channel
- Fraud riskActions taken to address identified fraud risks
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC3.3, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Risk assessment has no fraud component
- Insider misuse of IT access not considered
- Fraud risks identified but no mitigating control assigned
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.