SOC 2 CC3.3: fraud risk, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC3.3, the usual records are these.

• Fraud scenarios listed in the risk register
• A separation of duties matrix
• Approval records for payments and production changes

What Polara asks about it

The free readiness assessment asks 2 questions that bear on CC3.3. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Completed a formal information security risk assessment in the last 12 months? If yes, show it: risk assessment report with ratings, risk register spreadsheet, risk workshop notes, or risk review approval. If no, the fix: perform and document a formal risk assessment covering the in-scope system, with an owner for each identified risk.
• Does your risk assessment explicitly consider fraud and insider misuse? If yes, show it: risk register rows for fraud and insider misuse with their ratings, a risk assessment section on fraud scenarios, or workshop notes naming the scenarios considered. If no, the fix: add fraud and insider misuse scenarios to the risk assessment, each with an owner and a mitigation.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Risk Management Policy covers CC3.3.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Risk assessment policy template
• Risk register template

Is it in your scope?

Yes, always. CC3.3 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Risk assessment: the criteria around it

CC3.3 is one of 4 criteria in risk assessment, CC3.1 to CC3.4. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC3.1, risk objectives
• CC3.2, risk identification
• CC3.3, this page
• CC3.4, changes that add risk

Before it: CC3.2, risk identification. After it: CC3.4, changes that add risk. All the criteria are on the Trust Services Criteria page, grouped by category.