Risk assessment
Agents prepare each period’s risk assessment from Incidents, Issues and Changes, and the entity’s officer accepts it by Decision.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC3.1 | The entity specifies objectives precisely enough to identify and assess the risks that relate to them. |
| SOC2 CC3.2 | The entity identifies risks to its objectives across the entity and analyzes them to decide how to manage them. |
| SOC2 CC9.1 | The entity identifies, selects and develops risk mitigation activities for risks from potential business disruptions. |
| HIPAA 164.308(a)(1) | A covered entity implements policies and procedures to prevent, detect, contain and correct security violations, including risk analysis. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every report period of every entity in scope. |
| Assert | Each period has a risk assessment Document and an officer’s Decision accepting it, signed before the period ends. |
Owner
Example
At quarter end, Agents draft the risk assessment for a home-appraisal service from 3 Incidents, 12 Issues and 80 Changes. The officer accepts it by Decision before the quarter closes.