Question
During a SOC 2 Type 2 examination, the service auditor confirms that an automated invoice-matching edit check has run the same code since the start of the period and that the entity's change and access controls over the application operated effectively. Why can the auditor test fewer instances of this automated control than of a manual approval?
Tap card to flipAnswer
An automated control performs the same way each time it runs while its program, configuration and data stay unchanged, so one well-designed test supports an inference about the later executions. That inference holds only because general IT controls over change, access and operations prevent silent alteration of the logic. A manual approval depends on a person's attention on each occasion, so it needs a larger sample to support the same conclusion.
Tap card to flip back