CC3.3
CC3.3
Assesses fraud risk
The entity considers the potential for fraud in assessing risks to the achievement of objectives. (COSO Principle 8)
Category
Security
Subcategory
Risk Assessment
Points of Focus
Considers Various Types of Fraud
The assessment of fraud considers fraudulent reporting, possible loss of assets, and corruption resulting from the various ways that fraud and misconduct can occur.
Assesses Incentives and Pressures
The assessment of fraud risks considers incentives and pressures.
Assesses Opportunities
The assessment of fraud risk considers opportunities for unauthorized acquisition, use, or disposal of assets, altering the entity's reporting records, or committing other inappropriate acts.
Assesses Attitudes and Rationalizations
The assessment of fraud risk considers how management and other personnel might engage in or justify inappropriate actions.
Considers the Risks Related to the Use of IT and Access to Information
The assessment of fraud risks includes consideration of internal and external threats and vulnerabilities that arise specifically from the use of IT and access to information.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Third-Party Management | Third-Party Service Reviews | Documented evidence of a formal, annual stakeholder review of third-party services for each Third-Party Service Provider (TSP). |
| Third-Party Management | Third-Party Terms & Conditions | Documented evidence of terms and conditions for external systems. |
| Compliance | Manufacturer Disclosure Statement for Medical Device Security (MDS2) | Documented Manufacturer Disclosure Statement for Medical Device Security (MDS2) that communicates information about medical device cybersecurity & data privacy characteristics to current device owners and potential buyers. [note MDS2 is specific to medical device manufacturers] |
| Third-Party Management | Third-Party Contracts | Documented evidence of third-party contractual obligations for cybersecurity & data privacy protections. |
| Threat Management | Threat Intelligence Program (TIP) | Documented evidence of a formal capability that intakes and analysis threat information to determine specific threat to the organization and necessary actions to mitigate the threat(s). |
| Threat Management | Indicators of Exposure (IOE) | Documented evidence of defined Indicators of Exposure (IOE). |
Policies
- Risk Management Standard - Establishes the framework for identifying, assessing, and managing information security risks
Example Organization Controls
- CC3.3.1 - The annual risk assessment includes consideration of fraud risk including unauthorized access and data manipulation.
Example Control Objectives
- Risk identification and management - Risks to achievement of objectives are identified, analyzed, and managed through a formal risk assessment process.
Example Evidence
- Annual Risk Assessment Report - Annual risk assessment covering objectives, fraud, change, and business disruption risks with documented ratings and mitigation strategies