US CMA PART 1 – Standard Costing & Variance Analysis – Notes

US CMA PART 1 – Standard Costing & Variance Analysis – Notes

US CMA PART 1 – Standard Costing & Variance Analysis –  Notes

#### 1. Fundamentals

- Standard Cost = Predetermined cost allowed for actual output under efficient conditions.

- Variance = Actual – Standard / Budget. Always flex standard to ACTUAL OUTPUT.

- Golden Rule: Distinguish AQ Purchased vs AQ Used vs SQ Allowed for actual output.

*F / U Logic*

- Cost: Actual > Standard = U. Actual < Standard = F.

- Revenue / CM: Actual > Standard = F. Actual < Standard = U.

- F does not always mean good. Example: Cheap material = F price but U usage + U labor efficiency.

#### 2. Direct Materials

*Price Variance* = (AP - SP) x AQ Purchased

If question says recognized at use, use AQ Used. Follow question instruction.

*Quantity / Usage Variance* = (AQ Used - SQ Allowed) x SP

SQ = Standard qty per unit x Actual output.

*Total Material Variance* = (AQ Used x AP) - (SQ Allowed x SP)

If price variance uses Purchased qty, Price + Usage will NOT reconcile due to inventory change – Exam Trap.

#### 3. Direct Labor

*Rate Variance* = (AR - SR) x AH

*Efficiency Variance* = (AH - SH) x SR

SH = Standard hours per unit x Actual output

*Total Labor Variance* = Rate + Efficiency

Interdependence: Poor material quality → U material usage + U labor efficiency.

#### 4. Variable Overhead – MUST KNOW

SVOR = Standard Variable Overhead Rate per hour

AVOHR = Actual VOH Rate

*VOH Spending Variance* = Actual VOH - (AH x SVOR) = (AVOHR - SVOR) x AH

*VOH Efficiency Variance* = (AH - SH) x SVOR

*Total VOH Variance* = Actual VOH - (SH x SVOR) = Spending + Efficiency

Reason: Spending = over/under spent for hours worked. Efficiency = effect of working more/less hours.

#### 5. Fixed Overhead – MUST KNOW

Budgeted FOH = Fixed overhead budgeted for period

SFOR = Standard Fixed Overhead Rate = Budgeted FOH / Denominator hours or units

Applied FOH = SH x SFOR

*FOH Spending / Budget Variance* = Actual FOH - Budgeted FOH

*FOH Production Volume Variance* = Budgeted FOH - Applied FOH = Budgeted FOH - (SH x SFOR)

Volume variance is CAPACITY variance, not spending control. If Actual output < Denominator = U (under-applied). If Actual output > Denominator = F.

*Never confuse FOH Volume with VOH Efficiency.*

#### 6. Overhead Analysis – 2-Way, 3-Way, 4-Way – ADDED TOPIC – HIGHLY TESTED

This is for TOTAL Factory Overhead (VOH + FOH)

Let:

Budgeted VOH = SVOR x Denominator Hours OR Budgeted hours? For flex budget, use: Budgeted FOH + (SVOR x SH) or (SVOR x AH) depending on variance.

*Most Tested Method as per IMA / Gleim / Hock:*

*A. 2-Way Analysis:*

1.  Budget (Controllable) Variance = Actual Total OH - Budgeted Total OH for SH

    Budgeted for SH = Budgeted FOH + (SVOR x SH)

2.  Volume Variance = Budgeted Total OH for SH - Applied Total OH

    Applied = SH x Total Std Rate = SH x (SVOR+SFOR)

    OR simply = FOH Volume variance (VOH has no volume variance)

2-Way: Budget Variance shows spending + efficiency combined. Volume shows capacity.

*B. 3-Way Analysis:*

1.  Spending Variance = Actual Total OH - Budgeted Total OH for AH

    Budgeted for AH = Budgeted FOH + (SVOR x AH)

2.  Efficiency Variance = (AH - SH) x SVOR  (This is ONLY VOH Efficiency)

3.  Volume Variance = Budgeted FOH - Applied FOH (Same as FOH Volume)

3-Way Check: Total Overhead Variance = Spending + Efficiency + Volume

*C. 4-Way Analysis – Most Detailed:*

1.  VOH Spending Variance = Actual VOH - (AH x SVOR)

2.  VOH Efficiency Variance = (AH - SH) x SVOR

3.  FOH Spending Variance = Actual FOH - Budgeted FOH

4.  FOH Volume Variance = Budgeted FOH - (SH x SFOR)

4-Way: Total OH Variance = 1+2+3+4

*Exam Trick:* If question gives combined overhead rate, split it into VOH and FOH rates first.

#### 7. Material Mix & Yield Variances – You are correct

When product uses 2+ materials:

Total Input = Sum of actual quantities of all materials

RSQ = Revised Standard Qty = Actual Total Input x Standard Mix %

*Mix Variance* = Σ (AQ - RSQ) x SP

F/U depends on using more of expensive material = U

*Yield Variance* = (Actual Total Input - Standard Total Input Allowed for actual output) x Weighted Avg SP of standard mix

OR Yield = Total Quantity Variance - Mix Variance

*Relationship:* Materials Quantity Variance = Mix Variance + Yield Variance

#### 8. Sales Variances – Contribution Approach for CMA

*Sales Price Variance* = (Actual Price - Std Price) x Actual Qty Sold

*Sales Volume Variance (CM)* = (Actual Qty - Budgeted Qty) x Std CM per unit

*For Multi-Product:*

Actual Total Units = AT, Budgeted Total Units = BT

Budgeted Mix % = Budget %

Revised Budget Units = AT x Budget Mix %

*Sales Mix Variance* = Σ (Actual Units - Revised Budget Units) x Std CM

*Sales Quantity Variance* = Σ (Revised Budget Units - Budgeted Units) x Std CM

OR = (AT - BT) x Weighted Avg Budgeted CM

*Check:* Sales Volume Variance = Mix + Quantity

Trap: Favorable Mix can happen even if total units flat – just selling more high-margin products.

#### 9. Disposal of Variances

- Unfavorable = Debit, Favorable = Credit in variance accounts.

- WIP, FG, Raw Material at Standard Cost. Variances recorded separately.

- At year-end:

    - If Immaterial: Close all variances to COGS.

    - If Material: Prorate among WIP, FG, COGS per GAAP – but for CMA exam, assume close to COGS unless stated material.

#### 10. Quick Revision Formula Sheet for Exam

Variance Formula Sign

Mat Price (AP-SP) x AQ Purch AP>SP=U

Mat Qty (AQ Used - SQ) x SP AQ>SQ=U

Labor Rate (AR-SR) x AH AR>SR=U

Labor Eff (AH-SH) x SR AH>SH=U

VOH Spend Actual VOH - AHxSVOR + = U

VOH Eff (AH-SH) x SVOR + = U

FOH Spend Actual FOH - Budgeted FOH + = U

FOH Vol Budgeted FOH - SHxSFOR Budgeted>Applied = U

Total OH 2-way Budget Actual OH - (Budgeted FOH+SHxSVOR)

Total OH 2-way Volume (Budgeted FOH+SHxSVOR) - Applied

#### 11. Final Strategy for GMSISuccess Students

1.  *Always flex:* Calculate SQ and SH for ACTUAL output first.

2.  *Price vs Usage:* Price/Rate uses AH/AQ. Efficiency uses SR/SP.

3.  *Overhead:* Identify if question asks 2/3/4 way. For 3-way, remember Budgeted for AH vs Budgeted for SH.

4.  *Interdependence:* Link variances – Don't judge manager on one variance.

5.  *Mix/Yield:* Mix = Proportion, Yield = Total input vs output.

Here are 100 mock test questions on Variance Analysis for the US CMA Part 1 exam, each with a concise, one-line answer.

Direct Materials Variances

1. Q: What is the formula for the direct materials price variance?

   A: (Actual Price – Standard Price) × Actual Quantity Purchased.

2. Q: What is the formula for the direct materials usage (quantity) variance?

   A: (Actual Quantity Used – Standard Quantity Allowed) × Standard Price.

3. Q: A company bought 35,000 units of material for $105,000. If the standard price is $2.50, what is the actual price per unit?

   A: $3.00 per unit ($105,000 ÷ 35,000).

4. Q: If the actual price is $3.00 and the standard price is $2.50 for 25,000 units purchased, what is the materials price variance?

   A: $12,500 Unfavorable [( $3.00 – $2.50 ) × 25,000].

5. Q: Standard quantity is 24,000 units. A $2,500 unfavorable quantity variance occurs at a standard price of $2.50. What was the actual quantity used?

   A: 25,000 units (24,000 + ( $2,500 ÷ $2.50 )).

6. Q: If actual quantity used is 108,000 lbs and standard quantity allowed is 110,000 lbs at a standard price of $3.60, what is the usage variance?

   **A:** $7,200 Favorable [(108,000 – 110,000) × $3.60].

7. Q: An unfavorable materials usage variance is most likely to cause which other variance to be unfavorable?

   A: An unfavorable labor efficiency (usage) variance, due to extra handling time.

8. Q: Does the actual sales volume directly impact the materials efficiency variance?

   A: No, sales volume does not affect the comparison of standard vs. actual production usage.

9. Q: When is the materials price variance typically isolated?

   A: At the time of purchase to provide the earliest possible feedback to the responsible manager.

10. Q: A raw material price variance is also known as what?

    A: The purchase price variance.

11. Q: If actual price is $2.02 and standard price is $2.00 for 500,000 lbs purchased, what is the price variance?

    A: $10,000 Unfavorable [( $2.02 – $2.00 ) × 500,000].

12. Q: What does a favorable materials price variance indicate?

    A: The actual price paid per unit was less than the standard price.

13. Q: What does an unfavorable materials quantity variance indicate?

    A: More materials were used in production than the standard allows for the actual output.

14. Q: The standard cost per unit of raw material is calculated using what?

    A: Budgeted production quantities and budgeted costs.

15. Q: A materials mix variance arises when a company uses what?

    A: A different combination of input materials than the standard mix.

16. Q: The materials yield variance measures the difference between the actual yield and what?

    A: The standard yield expected from the actual total inputs used.

17. Q: Who is generally responsible for the materials price variance?

    A: The purchasing manager.

18. Q: Who is generally responsible for the materials usage variance?

    A: The production manager.

19. Q: If a company produces 22,000 units requiring 5 lbs each, what is the standard quantity allowed?

    A: 110,000 lbs (22,000 units × 5 lbs).

20. Q: A favorable usage variance means actual quantity used was ______ than standard quantity allowed.

    A: Less.

Direct Labor Variances

21. Q: What is the formula for the direct labor rate variance?

    A: (Actual Rate – Standard Rate) × Actual Hours Worked.

22. Q: What is the formula for the direct labor efficiency variance?

    A: (Actual Hours – Standard Hours Allowed) × Standard Rate.

23. Q: Actual labor cost is $327,600 for 28,000 hours. What is the actual rate?

    **A:** $11.70 per hour ($327,600 ÷ 28,000).

24. Q: If the actual rate is $11.70 and the standard rate is $12.00 for 28,000 hours, what is the rate variance?

    A: $8,400 Favorable [( $11.70 – $12.00 ) × 28,000].

25. Q: Standard hours for 22,000 units at 1.25 hrs/unit is what?

    A: 27,500 hours (22,000 × 1.25).

26. Q: If actual hours are 28,000 and standard hours are 27,500 at a $12 rate, what is the efficiency variance?

    **A:** $6,000 Unfavorable [(28,000 – 27,500) × $12].

27. Q: Standard hours for 5,200 units at 1.25 hrs/unit is what?

    A: 6,500 hours (5,200 × 1.25).

28. Q: If actual hours are 6,600 and standard hours are 6,500 at $12/hr, what is the labor efficiency variance?

    **A:** $1,200 Unfavorable [(6,600 – 6,500) × $12].

29. Q: A new labor contract signed before the budgeting cycle is a valid explanation for a labor rate variance. True or False?

    A: False, the new rates should have been incorporated into the standard.

30. Q: An unfavorable labor efficiency variance means actual hours were ______ than standard hours.

    A: Greater.

31. Q: Who is typically responsible for the labor rate variance?

    A: The HR or production manager, depending on the cause (e.g., using higher-skilled workers).

32. Q: Who is typically responsible for the labor efficiency variance?

    A: The production supervisor.

33. Q: If workers are paid a higher rate than standard, the labor rate variance is ______.

    A: Unfavorable.

34. Q: If production is inefficient and takes more hours than standard, the efficiency variance is ______.

    A: Unfavorable.

35. Q: The total direct labor variance is the sum of which two variances?

    A: The labor rate variance and the labor efficiency variance.

36. Q: A favorable labor rate variance might be caused by using lower-skilled workers, which could lead to what?

    A: An unfavorable labor efficiency variance.

37. Q: Standard labor rate is $12/hr. Actual hours are 28,000. Actual cost is $327,600. Is the rate variance favorable or unfavorable?

    A: Favorable, because $11.70 actual < $12.00 standard.

38. Q: An efficiency variance is also known as a ______ variance.

    A: Usage or quantity variance.

39. Q: If idle time increases, what happens to the labor efficiency variance?

    A: It becomes more unfavorable.

40. Q: The labor efficiency variance is calculated using the ______ price/rate.

    A: Standard.

Variable Overhead Variances

41. Q: What are the two components of the total variable overhead variance?

    A: The variable overhead spending (rate) variance and the variable overhead efficiency variance.

42. Q: What is the formula for the variable overhead spending variance?

    A: (Actual Variable OH Rate – Standard Variable OH Rate) × Actual Hours (or Actual OH – (Standard Rate × Actual Hours)).

43. Q: What is the formula for the variable overhead efficiency variance?

    A: (Actual Hours – Standard Hours Allowed) × Standard Variable OH Rate.

44. Q: The variable overhead efficiency variance is driven by the efficiency of what?

    A: The cost driver (e.g., direct labor hours).

45. Q: If actual variable OH is $294,000, actual DLH is 48,000, and the standard rate is $6.00/DLH, what is the spending variance?

    A: $6,000 Favorable [$294,000 – (48,000 × $6.00)].

46. Q: Using the data above (standard DLH allowed = 49,500), what is the variable OH efficiency variance?

    A: $9,000 Favorable [(48,000 – 49,500) × $6.00].

47. Q: A favorable variable overhead spending variance means actual spending was ______ than the flexible budget amount.

    A: Less.

48. Q: Variable overhead efficiency variance is unfavorable when actual hours are ______ than standard hours.

    A: Greater.

49. Q: If variable overhead is applied based on machine hours, the efficiency variance measures the efficiency of what?

    A: Machine hours usage.

50. Q: Who is generally responsible for the variable overhead spending variance?

    A: The production manager or cost center manager.

51. Q: The variable overhead efficiency variance is essentially a measure of what?

    A: The efficient use of the overhead allocation base (e.g., labor hours).

52. Q: If the standard variable OH rate is $6 and actual hours are 48,000, what is the standard variable OH applied for the actual hours?

    **A:** $288,000 (48,000 × $6).

53. Q: A favorable efficiency variance for variable overhead means the company used ______ of the allocation base than standard.

    A: Less.

54. Q: The total variable overhead variance is the difference between actual variable overhead and what?

    A: Standard variable overhead applied to actual production.

55. Q: Variable overhead spending variance is also called the ______ variance.

    A: Rate variance.

56. Q: If actual variable overhead is less than the flexible budget for actual hours, the spending variance is ______.

    A: Favorable.

57. Q: The variable overhead efficiency variance is calculated using the ______ overhead rate.

    A: Standard.

58. Q: An unfavorable labor efficiency variance will often cause what type of variable overhead efficiency variance?

    A: An unfavorable one, if labor hours are the allocation base.

59. Q: Variable overhead variances are most meaningful when analyzed ______.

    A: On a flexible budget basis.

60. Q: The variable overhead spending variance can be caused by price changes in what?

    A: Overhead items like indirect materials or utilities.

Fixed Overhead Variances

61. Q: What are the two components of the total fixed overhead variance under absorption costing?

    A: The fixed overhead spending (budget) variance and the fixed overhead volume variance.

62. Q: What is the formula for the fixed overhead spending variance?

    A: Actual Fixed Overhead – Budgeted Fixed Overhead.

63. Q: What is the formula for the fixed overhead volume variance?

    A: (Denominator Hours – Standard Hours Allowed) × Standard Fixed OH Rate, or Budgeted Fixed OH – Applied Fixed OH.

64. Q: The fixed overhead volume variance measures the utilization of what?

    A: Production capacity (denominator level).

65. Q: If a company produces less than the denominator level, the volume variance is ______.

    A: Unfavorable.

66. Q: If actual fixed overhead equals the budget, the spending variance is ______.

    A: Zero.

67. Q: The fixed overhead volume variance is not a measure of ______.

    A: Cost control (spending).

68. Q: A favorable volume variance means actual production exceeded what?

    A: The denominator level of activity.

69. Q: Fixed overhead spending variance is also known as the ______ variance.

    A: Budget variance.

70. Q: Who is responsible for the fixed overhead spending variance?

    A: Management (e.g., department heads) responsible for the fixed cost items.

71. Q: Who is responsible for the fixed overhead volume variance?

    A: Production management, as it relates to capacity utilization.

72. Q: The fixed overhead volume variance arises because of a difference between the denominator level and what?

    A: Standard hours allowed for actual output.

73. Q: If denominator hours are 10,000 and standard hours allowed are 9,000 at a standard rate of $5, what is the volume variance?

    **A:** $5,000 Unfavorable [(10,000 – 9,000) × $5].

74. Q: A fixed overhead volume variance is only calculated under which costing method?

    A: Absorption costing.

75. Q: Under variable costing, is a fixed overhead volume variance calculated?

    A: No.

76. Q: If budgeted fixed overhead is $100,000 and applied fixed overhead is $90,000, what is the volume variance?

    A: $10,000 Unfavorable.

77. Q: The fixed overhead spending variance is the difference between actual fixed overhead and what?

    A: The static budget fixed overhead.

78. Q: A volume variance is favorable when standard hours allowed ______ denominator hours.

    A: Exceed.

79. Q: The sum of the fixed overhead spending and volume variances equals the total fixed overhead variance. True or False?

    A: True (under absorption costing).

80. Q: The fixed overhead volume variance is a measure of ______.

    A: Capacity utilization.

Sales Variances

81. Q: What is the formula for the total sales variance?

    A: (Actual Selling Price – Standard Selling Price) × Actual Units Sold.

82. Q: The sales price variance isolates the effect of changes in what?

    A: Selling price.

83. Q: The sales volume variance measures the effect of selling a different number of units than budgeted. True or False?

    A: True.

84. Q: A favorable sales price variance means the actual selling price was ______ than the standard.

    A: Higher.

85. Q: A $250,000 favorable flexible-budget revenue variance can be wholly explained by changes in what?

    A: Unit selling prices.

86. Q: The sales volume variance can be broken down into what two sub-variances?

    A: The sales mix variance and the sales quantity variance.

87. Q: The sales mix variance arises because the actual sales mix differs from what?

    A: The budgeted (standard) sales mix.

88. Q: The sales quantity variance measures the impact of selling a different total volume of units, holding what constant?

    A: The budgeted sales mix.

89. Q: If a company sells more units than budgeted, the sales volume variance is generally ______.

    A: Favorable (assuming a positive contribution margin).

90. Q: Sales variances are typically calculated on what basis?

    A: Contribution margin basis.

91. Q: The sales price variance is calculated using the ______ number of units sold.

    A: Actual.

92. Q: A sales mix variance is a subset of what larger variance?

    A: The sales volume variance.

93. Q: If a company sells a higher proportion of low-margin products, the sales mix variance will likely be ______.

    A: Unfavorable.

94. Q: The sales quantity variance is also known as the ______ variance.

    A: Sales volume (in units) variance.

95. Q: A flexible budget is adjusted for what?

    A: The actual level of activity (sales or production).

96. Q: The difference between actual revenue and flexible budget revenue is due only to what?

    A: The difference between actual and budgeted selling prices.

97. Q: The static budget variance is the difference between actual results and what?

    A: The static (master) budget.

98. Q: If actual sales volume equals budgeted sales volume, the sales volume variance is ______.

    A: Zero.

99. Q: The sales mix variance helps managers understand the impact of changes in what?

    A: The relative profitability of products sold.

100. Q: A performance report utilizing flexible budgeting would compare actual costs to what?

     A: The flexible budget for the actual activity level.

Below are four CMA Part 1-style illustrations of variance analysis, with calculations, interpretation, and how the variances interconnect. Assume absorption costing for fixed overhead.

---

Illustration 1 — Direct Materials: Price vs. Usage Trade-off

Data

· Standard: 5 kg per unit @ $4.00/kg

· Actual production: 10,000 units

· Actual quantity purchased and used: 52,000 kg

· Actual price: $4.20/kg

· Standard quantity allowed = 10,000 × 5 = 50,000 kg

Calculations

· Materials price variance (MPV) = (AP − SP) × AQ = ($4.20 − $4.00) × 52,000 = $10,400 U

· Materials usage variance (MUV) = (AQ − SQ) × SP = (52,000 − 50,000) × $4.00 = **$8,000 U**

· Total materials variance = $10,400 U + $8,000 U = $18,400 U

Interpretation

The company paid more per kg and also used more kg than standard. Purchasing is mainly responsible for the price variance; production is mainly responsible for the usage variance.

Interconnectivity

Price and usage variances often trade off. For example, buying cheaper, lower-grade material may create a favorable price variance but an unfavorable usage variance due to more waste. Conversely, higher-quality material may be unfavorable on price but favorable on usage. Managers must evaluate the net effect, not each variance in isolation.

---

Illustration 2 — Direct Labor and Variable Overhead: Rate vs. Efficiency

Data

· Standard labor: 2 hours per unit @ $15.00/hour

· Standard variable OH rate: $5.00 per direct labor hour

· Actual output: 5,000 units

· Actual direct labor hours: 10,500

· Actual labor rate: $14.50/hour

· Actual variable OH: $54,000

· Standard hours allowed = 5,000 × 2 = 10,000 hours

Labor variances

· Labor rate variance = (AR − SR) × AH = ($14.50 − $15.00) × 10,500 = $5,250 F

· Labor efficiency variance = (AH − SH) × SR = (10,500 − 10,000) × $15 = **$7,500 U**

· Total labor variance = $5,250 F + $7,500 U = $2,250 U

Variable overhead variances

· VOH spending variance = Actual VOH − (Standard rate × Actual hours)

    = $54,000 − (10,500 × $5) = $54,000 − $52,500 = $1,500 U

· VOH efficiency variance = (AH − SH) × Standard VOH rate

    = (10,500 − 10,000) × $5 = **$2,500 U**

· Total VOH variance = $1,500 U + $2,500 U = $4,000 U

Interpretation

The company paid less per labor hour but used more hours than standard. The lower rate may reflect using less-skilled workers, which can explain the unfavorable labor efficiency variance. Variable overhead is also unfavorable because more labor hours were used and because actual VOH spending exceeded the flexible budget.

Interconnectivity

· Labor rate and labor efficiency often move in opposite directions: cheaper labor may be less productive.

· VOH efficiency variance mirrors labor efficiency when direct labor hours are the allocation base. More labor hours → more variable overhead applied/used.

· VOH spending variance is separate: it reflects price/control of overhead items, not hours used.

---

Illustration 3 — Fixed Overhead: Spending vs. Volume

Data

· Budgeted fixed overhead: $120,000

· Denominator activity: 12,000 direct labor hours

· Standard fixed OH rate = $120,000 ÷ 12,000 = $10/hour

· Actual fixed overhead: $123,000

· Standard hours allowed for actual output: 11,000 hours

Calculations

· Fixed OH spending variance = Actual FOH − Budgeted FOH

    = $123,000 − $120,000 = $3,000 U

· Fixed OH volume variance = (Denominator hours − Standard hours allowed) × Standard FOH rate

    = (12,000 − 11,000) × $10 = **$10,000 U**

· Total fixed OH variance = $3,000 U + $10,000 U = $13,000 U

Interpretation

The company overspent fixed overhead by $3,000 and produced less than the denominator capacity, creating an unfavorable volume variance. The spending variance is about cost control; the volume variance is about capacity utilization, not spending.

Interconnectivity

· Fixed OH spending variance is independent of production volume.

· Fixed OH volume variance moves with production volume: producing above denominator → favorable; below → unfavorable.

· Under variable costing, no fixed OH volume variance is calculated. Under absorption costing, it affects cost of goods sold and inventory.

---

Illustration 4 — Sales: Price vs. Volume

Data

· Budgeted sales: 10,000 units @ $50

· Actual sales: 9,500 units @ $52

Calculations

· Sales price variance = (Actual price − Standard price) × Actual units

    = ($52 − $50) × 9,500 = $19,000 F

· Sales volume variance = (Actual units − Budgeted units) × Standard price

    = (9,500 − 10,000) × $50 = **$25,000 U**

· Total sales variance = $19,000 F + $25,000 U = $6,000 U

Interpretation

The company sold at a higher price but at a lower volume. The price increase may have contributed to the volume decline. Overall revenue is still $6,000 below budget.

Interconnectivity

· Sales price and sales volume often trade off: increasing price can reduce volume.

· The sales volume variance can be further split into sales mix variance and sales quantity variance. Selling more of a low-margin product may create a favorable quantity variance but an unfavorable mix variance.

· Sales variances should be evaluated using contribution margin, not just revenue, to judge profitability.

---

Key Interconnectivity Summary

Variance area Main trade-off / connection

Materials price vs. usage Cheap/low-grade materials → favorable price, often unfavorable usage

Labor rate vs. efficiency Lower-skilled labor → favorable rate, often unfavorable efficiency

Labor efficiency vs. VOH efficiency Same driver (e.g., DLH) → often move in same direction

VOH spending vs. efficiency Spending = price/control; efficiency = hours/base usage

Fixed OH spending vs. volume Spending = cost control; volume = capacity utilization

Sales price vs. volume/mix Higher price may reduce volume; mix affects profitability

Exam point: Variances are not independent. A favorable variance in one area can cause an unfavorable variance in another. CMA questions often test whether you can calculate each variance and explain the net effect and responsibility.

Complete Study Notes :ISO 27001, Security Compliance,SOC1,SOC2

Complete Study Notes :ISO 27001, Security Compliance,SOC1,SOC2

Complete Study Notes :ISO 27001, Security Compliance,SOC1,SOC2.

These notes are organized systematically for students, IT auditors, CISA candidates, information security professionals and compliance interview preparation.

Here are your *COMPLETE EXAM-ORIENTED STUDY NOTES* for GMSISuccess – CISA / CPA / CIA Students – *ISO 27001 + Security Compliance + SOC 1 + SOC 2*

### 1. ISO 27001:2022 – INFORMATION SECURITY MANAGEMENT SYSTEM [ISMS]

*What is it?*

- International Standard for *Establishing, Implementing, Maintaining and Improving* an ISMS.

- Certifiable Standard – Issued by ISO. Certification valid for *3 years* with yearly surveillance audits.

- Latest version: *ISO 27001:2022* – 93 controls in Annex A.

*Structure – 10 Clauses [High Level Structure]:*

- Clause 4-10 are mandatory

- 4: Context of Organization

- 5: Leadership

- 6: Planning – Risk Assessment

- 7: Support

- 8: Operation

- 9: Performance Evaluation

- 10: Improvement

*Annex A – 93 Controls in 4 Themes:*

1. *Organizational – 37 controls* – Policies, Threat Intel, Incident Mgmt, Supplier relationships

2. *People – 8 controls* – Screening, Training, Disciplinary process

3. *Physical – 14 controls* – Physical entry, CCTV, Media disposal

4. *Technological – 34 controls* – Access control, Encryption, Secure coding, Logging, Data leakage prevention

*Key Documents to Audit:*

- *SoA – Statement of Applicability:* Heart of ISO 27001. Lists all 93 controls, which applicable, justification, implementation status. FIRST document auditor asks.

- *Risk Assessment & Risk Treatment Plan*

- *ISMS Scope Document*

*Certification Process:* Gap Assessment -> Risk Assessment -> SoA -> Implement Controls -> Internal Audit -> Stage 1 Audit -> Stage 2 Audit -> Certification[Documentation][Effectiveness]

*Who needs it?* Any company wanting to prove maturity of security to clients. Global standard.

---

### 2. SECURITY COMPLIANCE – BIG PICTURE

*Security Compliance = Adherence to laws, regulations, standards to protect information.*

Domain Regulation / Standard Applicability

**Privacy** GDPR, DPDP Act India, CCPA Personal Data

**Financial** SOX, PCI-DSS Financial Reporting, Card Data

**Cloud/SaaS** SOC 2, ISO 27017, CSA STAR Third Party Assurance

**Health** HIPAA US Health Data

**Outsourcing** RBI Outsourcing, DORA (EU), SEBI TPRM

*Auditor Approach:*

Compliance = Design + Operating Effectiveness + Continuous Monitoring.

---

### 3. SOC REPORTS – SSAE 18 STANDARD BY AICPA

*All SOC reports are governed by SSAE 18 by AICPA, issued by CPA firm.*

#### SOC 1 – INTERNAL CONTROL OVER FINANCIAL REPORTING [ICFR]

- *Purpose:* Controls relevant to CLIENT's FINANCIAL STATEMENTS. Can I trust this vendor for my financial reporting?

- *User:* User Entity's Financial Auditor + Management

- *Example Vendors:* Payroll Processor [ADP], Expense Processor, Loan Servicing, Claims Processor – Any vendor touching financials.

- *Framework:* Controls mapped to financial reporting objectives – Not fixed TSC.

- *Who reads:* CFO, External Auditor [EY]

- *Type:* Type 1 [Design at point in time] vs Type 2 [Operating Effectiveness over 6-12 months]

- *If qualified opinion in SOC 1?* – Financial Auditor cannot rely on vendor – Must do additional testing.[Deloitte]

#### SOC 2 – TRUST SERVICES CRITERIA – SECURITY, AVAILABILITY, CONFIDENTIALITY, PRIVACY, PROCESSING INTEGRITY

- *Purpose:* Controls relevant to SECURITY, AVAILABILITY, CONFIDENTIALITY of system. Can I trust this vendor with my DATA?

- *User:* Management, Clients, Regulators, Third Parties

- *Example Vendors:* AWS, Azure, SaaS, Data Center, Managed Security Provider – Any vendor hosting/processing data.

- *5 Trust Services Criteria [TSC] – By AICPA:*

   1. *Security [Common Criteria – Mandatory]:* Logical Access, Risk Assessment, System Monitoring – CC1 to CC8

   2. *Availability:* Uptime, DR, BCP – A1

   3. *Processing Integrity:* Completeness, Accuracy of processing – PI1

   4. *Confidentiality:* Encryption, Access to confidential info – C1

   5. *Privacy:* Personal info lifecycle as per privacy principles – P1 to P8

- *Type 1 vs Type 2 – Same logic:* Type 2 always preferred – Unqualified opinion within 12 months.

- *Opinion Types:* Unqualified, Qualified, Adverse [Major failure], Disclaimer [Cannot opine][Clean][Exceptions]

*CRITICAL CISA CONCEPTS IN SOC 2:*

- *CUEC – Complementary User Entity Controls:* Controls YOU must do. Vendor says – We are secure IF you also do quarterly access review. If you don't do CUEC, SOC 2 is useless for you. TPRM must track CUEC compliance.

- *Subservice Organizations / Carve-out vs Inclusive:* If vendor uses AWS and uses Carve-out method – AWS controls NOT covered in vendor's SOC 2 – You must get AWS SOC 2 separately. If Inclusive – Covered.

- *Management Assertion:* Management's claim that controls were effective.

- *System Description:* Vendor's own description of system boundaries.

#### SOC 3 – Public version of SOC 2 – General use – No confidential info – Can be put on website.

#### SOC 1 vs SOC 2 – DIRECT COMPARISON FOR EXAM:

Point SOC 1 SOC 2

**Focus** Financial Reporting – ICFR Data Security – Trust Services

**Question it answers** Can I trust vendor with my MONEY? Can I trust vendor with my DATA?

**Standard** SSAE 18 SSAE 18 + TSC

**Who needs it** Payroll, Financial processors Cloud, SaaS, IT vendors

**Framework** Client's financial controls AICPA TSC – 5 Criteria

**Restricted Use?** Yes – Restricted to user org & its auditor Yes – Restricted but wider audience

---

### 4. HOW TO REVIEW SOC REPORT – AUDIT PROCEDURE [CISA GOLD]

*5-Step Review:*

1. *Check Basics:* Report period [Is it within 12 months?], Auditor reputation [Big 4?], Type 2?

2. *Read Opinion:* Unqualified? If qualified, understand exception.

3. *Read Exceptions & Management Response:* Is exception related to my data? Has vendor remediated? Get evidence of remediation.

4. *Map CUECs:* Extract CUEC list and verify we implemented them. Document evidence.

5. *Check Subservice & Complementary Subservice Org Controls:* Need additional SOC reports?

*Red Flags:* Report older than 12 months, Type 1 only, Qualified opinion with no remediation, No coverage of Security criteria, Carve-out with no subservice SOC reports.

---

### 5. ISO 27001 vs SOC 2 – EXAM FAVORITE

ISO 27001 SOC 2

Certification for 3 years Attestation for 12-month period

93 controls – Annex A Trust Services Criteria – 5 TSC

Point-in-time + surveillance Tests Operating Effectiveness

Issued by ISO Certification Body Issued by CPA Firm [AICPA]

Global Acceptance US Market Mandate – SaaS must have

Proves ISMS maturity Proves security operationally worked

*Best Practice:* Mature companies get BOTH – ISO 27001 for ISMS, SOC 2 Type 2 for client assurance.

---

### 6. QUICK REVISION MNEMONICS:

- *SOC 1 = MONEY, SOC 2 = DATA*

- *TSC = SAPPC? Actually – Security is COMMON – S-A-P-C-P?* Remember: *"S ACPP" – Security, Availability, Confidentiality, Processing Integrity, Privacy*

- *CUEC = Vendor says – "My security works IF you also work"*

### Part 1: Foundations of Information Security

### 1.1 CIA Triad — Three Core Principles

The CIA Triad forms the foundation of information security.

\- Confidentiality

* Ensures that information is accessible only to authorized people.

* Protects against unauthorized disclosure, snooping and data theft.

* Common controls include encryption, passwords, multifactor authentication (MFA) and access permissions.

* Example: Only authorized customers can view their bank account details.

\- Integrity

* Ensures that information remains accurate, complete and protected against unauthorized changes.

* Protects against data manipulation, corruption and fraud.

* Common controls include digital signatures, hashes, validation checks, version control and audit logs.

* Example: A bank balance of ₹50,000 must not be changed without a valid transaction.

\- Availability

* Ensures that authorized users can access information and systems when required.

* Protects against outages, system crashes, ransomware and denial-of-service attacks.

* Common controls include backups, redundant servers, disaster recovery and business continuity plans.

* Example: Customers can access banking services when required, subject to scheduled maintenance.

\- Key exam point

* Confidentiality = Prevent unauthorized disclosure.

* Integrity = Prevent unauthorized or improper modification.

* Availability = Ensure timely access.

### 1.2 Information Security Management System (ISMS)

\- Definition

* An ISMS is an organization-wide framework of policies, processes, responsibilities, risk assessments and controls used to manage information security.

\- Key characteristics

* Integrates people, processes and technology.

* Identifies information security risks systematically.

* Establishes security policies and procedures.

* Assigns responsibilities and accountability.

* Monitors controls and investigates incidents.

* Supports continual improvement.

\- ISMS analogy

* An ISMS is like the operating system of an organization's security activities.

* It coordinates the different components required to protect information.

\- Without an effective ISMS

* Security activities may be reactive.

* Responsibilities may be unclear.

* Controls may be inconsistent.

* Documentation may be incomplete.

* Security incidents may go undetected.

\- With an effective ISMS

* Risks are identified proactively.

* Policies and procedures are documented.

* Management supports security initiatives.

* Controls are monitored and reviewed.

* Weaknesses are addressed systematically.

\- Example

* Without an ISMS, a company may discover a breach only after customer complaints.

* With an effective ISMS, monitoring tools may detect suspicious activity, and incident response procedures guide investigation and containment.

### 1.3 People, Process and Technology (PPT)

\- People

* Refers to employees, contractors, managers and other individuals involved in handling information.

* Security measures include:

    * Security awareness training.

    * Appropriate background screening.

    * Defined responsibilities.

    * Disciplinary procedures.

    * Secure employee onboarding and offboarding.

\- Process

* Refers to documented procedures and repeatable workflows.

* Examples include:

    * Incident response procedures.

    * Access approval workflows.

    * Backup schedules.

    * Change management procedures.

    * Business continuity plans.

\- Technology

* Refers to technical safeguards used to protect information.

* Examples include:

    * Firewalls.

    * Encryption.

    * Antivirus and endpoint protection.

    * Identity and access management.

    * Security monitoring systems.

\- Bank vault analogy

* People = Trained security guards.

* Process = Procedures for opening and closing the vault.

* Technology = Vault doors, alarms and surveillance cameras.

\- Key lesson

* A strong firewall cannot compensate fully for employees who disclose passwords.

* Well-trained employees cannot compensate fully for missing security procedures.

* Effective security requires all three pillars.

### Part 2: ISO/IEC 27001:2022 — Structure and Requirements

### 2.1 Meaning and Purpose of ISO 27001

* ISO/IEC 27001:2022 is an international standard specifying requirements for establishing, implementing, maintaining and continually improving an ISMS.

* Its main purpose is to help organizations manage information security risks systematically.

* It covers organizational, human, physical and technological security considerations.

* It promotes a risk-based approach instead of relying solely on a fixed checklist.

* Certification demonstrates conformity with the standard's requirements within the defined certification scope.

* Certification does not guarantee that a security breach will never occur.

### 2.2 Structure of ISO 27001:2022

\- Clauses 0–3

* Introduce the standard, its scope, normative references and terminology.

* Provide the foundation for understanding the requirements.

\- Clauses 4–10

* Contain the core requirements for the ISMS.

* Form the main basis for conformity assessment and certification audits.

\- Annex A

* Contains a reference set of security controls.

* Helps organizations determine whether relevant controls have been overlooked during risk treatment.

* Is not a universal checklist requiring every control to be implemented by every organization.

### 2.3 The Seven Core Clauses: Clauses 4–10

\- Clause 4 — Context of the Organization

* Understand the organization's internal and external issues.

* Identify interested parties and their relevant requirements.

* Determine the scope of the ISMS.

* Establish the overall context in which information security risks must be managed.

\- Clause 5 — Leadership

* Obtain top management commitment.

* Establish the information security policy.

* Assign roles, responsibilities and authorities.

* Ensure information security is integrated into organizational activities.

\- Clause 6 — Planning

* Identify and assess information security risks.

* Determine risk treatment options.

* Establish information security objectives.

* Plan the actions required to address risks and achieve objectives.

\- Clause 7 — Support

* Provide resources for the ISMS.

* Ensure personnel have appropriate competence.

* Conduct awareness and training activities.

* Establish communication arrangements.

* Maintain controlled documented information.

\- Clause 8 — Operation

* Implement and control planned processes.

* Conduct information security risk assessments at planned intervals and when significant changes are proposed or occur, as applicable.

* Implement risk treatment plans.

* Maintain evidence of relevant operational activities.

\- Clause 9 — Performance Evaluation

* Monitor and measure ISMS performance.

* Evaluate the effectiveness of controls.

* Conduct internal audits.

* Perform management reviews.

* Identify weaknesses and areas requiring attention.

\- Clause 10 — Improvement

* Identify and manage nonconformities.

* Take corrective action.

* Investigate causes of problems.

* Prevent recurrence where possible.

* Continually improve the suitability, adequacy and effectiveness of the ISMS.

\- House-building analogy

* Clause 4 = Determine what kind of house is needed.

* Clause 5 = Obtain the owner's commitment.

* Clause 6 = Prepare the plan.

* Clause 7 = Arrange workers, resources and tools.

* Clause 8 = Build the house.

* Clause 9 = Inspect the house.

* Clause 10 = Correct defects and improve the structure.

### 2.4 Annex A Controls — 93 Controls

* ISO/IEC 27001:2022 Annex A contains 93 reference controls.

* These controls are organized into four themes:

\- Organizational controls — 37

* Security policies.

* Roles and responsibilities.

* Asset management.

* Supplier security.

* Information security incident management.

\- People controls — 8

* Screening.

* Security awareness and training.

* Responsibilities after termination or change of employment.

* Disciplinary processes.

\- Physical controls — 14

* Physical entry controls.

* Protection of equipment.

* Secure areas.

* Physical security monitoring.

\- Technological controls — 34

* Access control.

* Cryptography.

* Logging and monitoring.

* Malware protection.

* Secure configuration.

\- Must all 93 controls be implemented?

* No, not automatically.

* Organizations determine the necessary controls through risk assessment and treatment.

* Annex A is used as a reference to check that relevant controls have not been overlooked.

* Other appropriate controls may also be selected or developed.

* Exclusions from Annex A should be justified and documented in the Statement of Applicability.

* A control required by an identified risk, legal obligation or other applicable requirement cannot simply be ignored because it is inconvenient.

\- Example

* A small consulting firm may emphasize client confidentiality, remote access and device security.

* A hospital may require extensive controls for patient information, clinical systems and service availability.

### 2.5 Statement of Applicability (SoA)

* The SoA is a documented statement identifying the necessary controls for the organization's ISMS.

* It connects risk assessment and risk treatment to control selection.

* It identifies which controls are included and why.

* It records whether necessary controls have been implemented.

* It provides justification for excluding Annex A controls.

\- Example

* Asset inventory: Included because the organization uses laptops, servers and cloud resources.

* Access control: Included to restrict access to confidential information.

* Cryptography: Included to protect sensitive information.

* Physical security: Addressed through the organization's own facilities and relevant cloud provider arrangements, as applicable.

\- Key exam point

* The SoA is not merely a list of implemented controls; it also records the necessary controls and the justification for exclusions.

### 2.6 Key ISO 27001 Terminology

\- Risk assessment

* Identifies risks and analyzes and evaluates them against established criteria.

\- Risk treatment

* Determines how identified risks will be modified or otherwise addressed.

\- Risk owner

* The person accountable for managing a particular risk.

\- Nonconformity

* Failure to fulfill an applicable requirement of the standard or another requirement within the ISMS.

\- Corrective action

* Action taken to address the cause of a nonconformity and prevent recurrence.

\- Risk treatment options

* Modify or mitigate: Introduce controls to reduce likelihood or impact.

* Avoid: Stop the activity creating the risk.

* Share or transfer: Allocate some risk through insurance, contracts or other arrangements.

* Accept: Retain the risk following an authorized decision under the organization's risk criteria.

\- Important distinction

* Transferring risk does not necessarily transfer all accountability.

* Accepting risk does not eliminate it.

### Part 3: Core Features of ISO 27001

### 3.1 What Makes ISO 27001 Different?

\- Risk-based approach

* Select controls according to assessed risks and relevant requirements.

* Prioritize security investment.

\- Leadership-driven

* Top management supports and oversees the ISMS.

* Security becomes an organizational responsibility.

\- Continual improvement

* Monitor results, identify weaknesses and correct deficiencies.

* Adapt to changing risks.

\- Holistic approach

* Addresses people, processes and technology.

* Reduces weaknesses caused by gaps between departments or controls.

\- International recognition

* Certification can strengthen customer confidence.

* It may support vendor qualification and contractual requirements.

* It does not guarantee that all possible risks have been eliminated.

### 3.2 PDCA Cycle — Plan, Do, Check, Act

\- Plan

* Identify risks.

* Establish objectives.

* Design appropriate controls.

* Example: Approve a policy for protecting customer records through backups.

\- Do

* Implement the planned controls.

* Assign responsibilities.

* Example: Configure automated backups and restrict access.

\- Check

* Monitor controls and evaluate results.

* Conduct testing and audits.

* Example: Restore backup data and verify completeness.

\- Act

* Correct deficiencies and improve procedures.

* Example: Identify a database excluded from backups, correct the configuration and retest.

\- Key lesson

* A policy alone is insufficient.

* Controls must be implemented, tested and improved.

\- Exam clarification

* PDCA is a useful continual-improvement model.

* ISO 27001:2022 does not require PDCA to be used as a specific named methodology.

### Part 4: ISO 27001 Across Industries

### 4.1 Manufacturing Industry

\- IT and OT security

* Connected machinery can be targeted by cyberattacks.

* Controls include network segmentation, restricted remote access and industrial system security.

\- Intellectual property protection

* Blueprints, formulas and CAD designs may be commercially valuable.

* Controls include classification, encryption and restricted access.

\- Supply chain security

* Compromised suppliers may create entry points into factory systems.

* Controls include supplier assessments, secure agreements and controlled vendor access.

\- Production continuity

* Ransomware or system failure can stop production.

* Controls include tested backups, incident response and recovery plans.

\- Example

* A cyberattack on a car manufacturer's networked assembly line could interrupt production.

* Network segmentation and tested recovery procedures can reduce the impact.

### 4.2 Service Industry

\- Customer data privacy

* Banks, hospitals, hotels and logistics firms handle sensitive information.

* Controls include access restrictions, encryption and privacy procedures.

\- System availability

* Service outages may disrupt customer transactions or operations.

* Controls include redundancy, disaster recovery and business continuity planning.

\- Regulatory compliance

* Organizations must identify and comply with applicable legal and contractual requirements.

* Examples include GDPR and India's DPDP legislation, subject to their applicable requirements and commencement provisions.

\- Payment security

* Unauthorized transactions and payment fraud require appropriate preventive and detective controls.

\- Example

* If a logistics tracking system becomes unavailable, customers may be unable to track deliveries.

* Recovery arrangements can reduce downtime and customer disruption.

### 4.3 Consultancy Organizations

\- People-related risks

* Former employees may retain access to confidential client data.

* Apply prompt access revocation and formal offboarding procedures.

\- Process-related risks

* Teams working for competing clients may access each other's confidential files.

* Use client-specific permissions and documented information-sharing procedures.

\- Technology-related risks

* Consultants work from hotels, airports and client offices.

* Use MFA, secure connections, device management and endpoint protection.

\- Physical security risks

* Printed documents or unlocked screens may expose client information.

* Apply clear desk and clear screen practices.

\- Business benefit

* ISO 27001 certification can strengthen a consultancy's credibility.

* It may help satisfy customer and tender requirements.

### Part 5: SOC Reports and Attestation Standards

### 5.1 SOC Reports Overview

* SOC stands for System and Organization Controls.

* SOC reports provide information and assurance about controls at service organizations.

* They are particularly useful when businesses outsource services such as payroll, cloud hosting and payment processing.

\- SOC 1

* Focuses on controls relevant to user entities' internal control over financial reporting.

* Used by financial auditors, controllers and accounting teams.

\- SOC 2

* Addresses relevant Trust Services Criteria.

* Categories include security, availability, processing integrity, confidentiality and privacy.

* A particular report may cover only the categories relevant to its scope.

\- SOC 3

* Provides general-use reporting on relevant Trust Services Criteria.

* Is less detailed than the restricted-use SOC 2 report.

\- Restaurant analogy

* SOC 1: Examination of controls relevant to financial reporting.

* SOC 2: Detailed examination of relevant system security and service controls.

* SOC 3: Public-facing summary of relevant assurance information.

### 5.2 SSAE 18 vs. SSAE 21

* SSAE stands for Statements on Standards for Attestation Engagements.

* These are US professional standards issued by the AICPA.

* SSAE 18 established and revised attestation requirements relevant to SOC engagements.

* SSAE 21 updated the attestation framework and clarified approaches for certain examination engagements.

\- Assertion-based examination

* Management prepares an assertion about the subject matter or relevant criteria.

* The practitioner evaluates the assertion using evidence.

\- Direct examination

* The practitioner directly evaluates the subject matter against suitable criteria.

* The practitioner reports a conclusion based on the examination.

\- Important clarification

* SSAE 21 did not make management assertions universally optional for ordinary SOC 2 engagements.

* Requirements depend on the engagement type and applicable professional standards.

* SSAE 21 became effective for relevant practitioner examination or review reports dated on or after June 15, 2022, subject to its applicability provisions.

\- Exam tip

* Do not memorize SSAE 18 as “assertion always mandatory” and SSAE 21 as “assertion never required.”

* Identify the engagement type and applicable reporting requirements.

### 5.3 SOC Type 1 vs. Type 2

\- Type 1

* Evaluates the suitability of control design and whether controls are implemented as described at a specified date.

* Example: Assessing firewall control design and implementation as of January 1.

* Analogy: A photograph.

\- Type 2

* Evaluates the suitability of control design and operating effectiveness over a specified period.

* May involve testing samples of logs, approvals and transactions.

* Example: Testing firewall controls during a six-month examination period.

* Analogy: A video recording.

\- Key distinction

* Type 1 = Point-in-time assessment.

* Type 2 = Period-based assessment.

* A Type 2 report does not guarantee that controls worked perfectly at every moment.

* Review the auditor's opinion, scope, exceptions and test results.

### 5.4 Main Components of a SOC 2 Report

\- Independent service auditor's report

* Identifies scope, responsibilities, procedures and opinion.

\- Management's assertion

* Provides management's formal assertion where required.

\- Description of the system

* Describes services, infrastructure, personnel, processes, data and system boundaries.

\- Trust Services Criteria, controls and tests

* Describes relevant controls and examination procedures.

* A Type 2 report includes evidence of tests of operating effectiveness and their results.

\- Other information, where included

* May contain additional material supplied by management.

* Such information must be distinguished from the auditor's opinion.

\- Important

* SOC 2 reports are not universally divided into exactly five mandatory sections.

* An auditor's opinion is not simply labelled “Pass” or “Fail”; it may be unmodified, qualified, adverse or disclaimed, depending on the circumstances.

### 5.5 Processing Integrity

\- Processing integrity concerns whether system processing is complete, valid, accurate, timely and authorized in accordance with the system's objectives.

\- Completeness

* All relevant transactions are processed.

\- Validity

* Only valid transactions are processed.

\- Accuracy

* Amounts and calculations are correct.

\- Timeliness

* Transactions are processed within the expected period.

\- Authorization

* Processing follows appropriate authorization rules.

\- Example

* An e-commerce platform processes 10,000 orders.

* All orders should be recorded.

* Prices and taxes should be calculated correctly.

* Transactions should be processed on time.

* Unauthorized transactions should be prevented.

### 5.6 Bridge Letters or Gap Letters

* A bridge letter addresses the period between the end of a SOC report's coverage and a later date.

* It is typically prepared by the service organization rather than issued as a new independent auditor's opinion.

\- Typical contents

* Reference to the previous SOC report.

* Identification of the period covered by that report.

* Information about significant changes or incidents since the report period.

* The date through which management's update applies.

\- Example

* A SOC 2 report covers January to December 2025.

* A customer assesses the provider in April 2026.

* The bridge letter addresses the intervening period.

\- Limitation

* A bridge letter is not equivalent to a new SOC examination.

* Its usefulness depends on its scope, wording and supporting evidence.

### Part 6: Vendor Management and Shared Responsibility

### 6.1 Subservice Organizations

* A subservice organization is a third party used by a service organization to perform part of the service being examined.

* Examples include cloud infrastructure providers, data centers and payment processors.

\- Carve-out method

* Relevant subservice organization controls are excluded from the service auditor's examination.

* The report describes the subservice organization and the applicable scope boundary.

* Customers may need to review a separate SOC report.

\- Inclusive method

* Relevant subservice organization controls are included in the examination.

* Requires appropriate coordination, evidence and reporting arrangements.

\- Key lesson

* Neither method automatically establishes that a vendor is secure.

* Customers must understand the scope of the report and any additional controls required.

### 6.2 Complementary User Entity Controls (CUECs)

* CUECs are controls that a service organization expects its customers to implement.

* The provider's safeguards may not be sufficient unless the customer fulfills its own responsibilities.

\- Examples

* Cloud infrastructure provider supplies hosting; customer configures MFA and permissions.

* Cloud database provider supplies storage; customer establishes appropriate backup and recovery arrangements.

* SaaS provider supplies user accounts; customer removes access when employees leave.

* Payroll provider processes payroll; customer submits accurate, authorized payroll information and reviews results.

\- Why CUECs matter

* Missing customer controls may prevent overall control objectives from being achieved.

* A vendor's SOC report does not certify the customer's environment.

\- Exam point

* Provider controls and customer controls are complementary, not interchangeable.

### Part 7: Understanding Subject Matter in Audits

### 7.1 Underlying Subject Matter vs. Subject Matter Information

\- Underlying subject matter

* The actual system, activity, condition or matter being evaluated.

* Example: A service organization's information system and control activities.

\- Subject matter information

* Information describing, measuring or evaluating the underlying subject matter against suitable criteria.

* Example: A system description or report about the effectiveness of controls.

\- Fitness tracker analogy

* Underlying subject matter = Actual physical activity.

* Subject matter information = Tracker report showing steps and estimated calories.

\- Why the distinction matters

* A report can be inaccurate even when the underlying activity occurred correctly.

* Auditors need suitable criteria and sufficient appropriate evidence.

* Depending on the engagement, practitioners may examine management-prepared information or directly evaluate the underlying subject matter.

\- Exam clarification

* SSAE 21 helps clarify direct examination and related attestation concepts.

* It does not mean that all SOC 2 engagements have abandoned management assertions.

### Part 8: Risk Management Fundamentals

### 8.1 Risk Register

\- A risk register is a documented record for identifying, assessing, assigning and tracking risks.

\- Typical contents

* Risk identification number.

* Risk description.

* Affected asset or business function.

* Threat and vulnerability.

* Potential financial, legal, operational and reputational impact.

* Likelihood and impact ratings.

* Inherent and residual risk ratings, where used.

* Risk owner.

* Existing controls.

* Proposed treatment actions.

* Status and review date.

\- Example

* Risk: Ransomware attack on file servers.

* Likelihood: 4 out of 5.

* Impact: 5 out of 5.

* Initial score: 20 out of 25.

* Owner: IT Manager.

* Treatment: Endpoint detection, access restrictions, offline or immutable backups and recovery testing.

* Status: In progress.

### 8.2 Risk Calculation

\- A simple qualitative risk formula is:

\- Risk score = Likelihood × Impact.

\- Likelihood scale

* 1 = Rare.

* 2 = Unlikely.

* 3 = Possible.

* 4 = Likely.

* 5 = Almost certain.

\- Impact scale

* 1 = Negligible.

* 2 = Minor.

* 3 = Moderate.

* 4 = Major.

* 5 = Severe or catastrophic.

\- Example

* Likelihood = 4.

* Impact = 5.

* Risk score = 4 × 5 = 20 out of 25.

\- Illustrative risk classifications

* Scores 1–4: Low.

* Scores 5–12: Medium.

* Scores 13–25: High.

* These thresholds are examples, not mandatory ISO 27001 thresholds.

* Each organization should establish consistent assessment and risk acceptance criteria.

* ISO 27001 does not require every organization to use the multiplication formula.

### 8.3 Risk Heat Map

* A risk heat map compares likelihood and impact.

* Higher scores generally indicate greater priority for treatment.

| Impact / Likelihood | 1   | 2   | 3   | 4   | 5   |

| ------------------- | --- | --- | --- | --- | --- |

| 5 — Severe          | 5   | 10  | 15  | 20  | 25  |

| 4 — Major           | 4   | 8   | 12  | 16  | 20  |

| 3 — Moderate        | 3   | 6   | 9   | 12  | 15  |

| 2 — Minor           | 2   | 4   | 6   | 8   | 10  |

| 1 — Negligible      | 1   | 2   | 3   | 4   | 5   |

* Low risks may be monitored.

* Medium risks may require proportionate controls.

* High risks should be prioritized and escalated under the organization's procedures.

### 8.4 Inherent Risk vs. Residual Risk

\- Inherent risk

* Risk assessed before considering the relevant controls.

* Example: Ransomware risk rated 4 × 5 = 20.

\- Residual risk

* Risk remaining after considering implemented controls and their effectiveness.

* Example: After effective safeguards, likelihood falls to 2 and impact remains 5.

* Residual score = 2 × 5 = 10.

\- Key distinction

* Inherent risk = Before relevant controls.

* Residual risk = After considering controls.

* A lower residual score does not automatically mean the risk is acceptable.

* Compare residual risk with approved risk criteria and determine whether further treatment or authorized acceptance is required.

### Part 9: Asset Management

### 9.1 Asset Inventory

* An asset inventory records information assets and resources that store, process, transmit or protect information.

* Its purpose is to help the organization understand what must be protected.

\- Hardware assets

* Laptops.

* Servers.

* Routers.

* Mobile phones.

* Printers.

\- Software and cloud assets

* Applications.

* Databases.

* SaaS subscriptions.

* AWS and Azure accounts.

\- Information assets

* Customer databases.

* Source code.

* Financial records.

* Patents and confidential documents.

\- People and roles

* Employees.

* Contractors.

* Privileged users.

* Asset owners and custodians.

\- Facilities

* Offices.

* Data centers.

* Server rooms.

* Secure document storage areas.

\- Typical asset register fields

* Asset ID.

* Asset description.

* Owner.

* Location.

* Classification.

* Access requirements.

* Lifecycle status.

\- Example

* SRV-001: Production database server, owned by IT, located in Data Center A, classified as high sensitivity.

* DB-CUST: Customer personal data, owned by the relevant business data owner, stored in a cloud environment, classified according to its sensitivity.

\- Benefits

* Supports risk assessment.

* Establishes ownership.

* Helps select controls.

* Supports incident investigation.

* Assists with secure disposal and lifecycle management.

### Part 10: Change Management

### 10.1 Types of Changes

\- Standard change

* Routine, low-risk and repeatable.

* Pre-authorized under an approved procedure.

* Example: Routine patch deployment under an approved schedule.

\- Normal change

* Non-routine and subject to assessment.

* Requires the prescribed review, testing and authorization.

* Example: Major software upgrade or cloud migration.

\- Emergency change

* Required urgently to address a critical incident or risk.

* Uses expedited authorization.

* Requires documentation and appropriate retrospective review.

* Example: Urgent patch for a serious actively exploited vulnerability.

### 10.2 Normal Change Management Process

* Raise a change request.

* Assess business impact, risks and dependencies.

* Test the proposed change.

* Prepare a rollback plan.

* Obtain the required approval.

* Implement the change.

* Verify the outcome.

* Document the result.

### 10.3 Emergency Change Management Process

* Identify the urgent problem.

* Obtain expedited authorization.

* Implement the necessary change safely.

* Verify service restoration or risk reduction.

* Complete documentation.

* Conduct the required retrospective review.

\- Key exam points

* Standard change = Pre-authorized routine activity.

* Normal change = Assessed and approved change.

* Emergency change = Urgent change with expedited controls.

* Emergency does not mean uncontrolled.

* Standard does not mean undocumented.

* A Change Advisory Board (CAB) may advise on or approve changes, depending on the organization's arrangements.

### Part 11: Privacy and Legal Concepts

### 11.1 Cookies and Consent

\- Cookie

* A small piece of data stored in a browser by a website.

* May support login sessions, shopping carts, analytics and advertising.

\- Consent

* One possible legal basis for processing personal data.

* Must satisfy the requirements of the applicable law where consent is relied upon.

\- Essential cookies

* Support necessary functions such as login sessions or shopping carts.

* May qualify for an exemption from consent requirements where strictly necessary.

\- Analytics cookies

* Measure website usage and user behavior.

* Often require consent, depending on the applicable jurisdiction and implementation.

\- Marketing cookies

* Support advertising and tracking.

* Commonly require consent under applicable privacy and cookie rules.

\- GDPR consent principles

* Freely given.

* Specific.

* Informed.

* Unambiguous.

* Capable of being withdrawn.

\- Important

* A cookie banner is not automatically compliant merely because it displays an “Accept All” button.

* The design, available choices and actual tracking behavior matter.

* GDPR requirements should not be automatically applied as if they were identical to India's legal requirements.

* Indian organizations should assess the applicable DPDP legislation, rules and commencement provisions.

### 11.2 Master Service Agreement (MSA)

* Establishes the overall legal and commercial relationship between parties.

* May cover:

    * Intellectual property ownership.

    * Confidentiality.

    * Payment terms.

    * Indemnification.

    * Limitation of liability.

    * Dispute resolution.

    * Termination.

    * Data protection responsibilities.

\- Purpose

* Defines the general contractual framework.

* Helps allocate responsibilities and manage legal risks.

### 11.3 Service Level Agreement (SLA)

\- Defines measurable service performance commitments.

\- Common SLA metrics

* Availability or uptime.

* Incident response time.

* Resolution targets.

* Escalation procedures.

* Service credits or other contractual remedies.

\- Example

* Uptime target: 99.9% per month.

* Critical incident acknowledgment: Within one hour.

* Critical incident resolution target: Four hours, where contractually agreed.

\- Key distinction

* Response time = Time taken to acknowledge or begin responding.

* Resolution time = Time taken to resolve the issue.

### 11.4 Cloud Service Agreements

* Define terms and responsibilities for cloud services.

* Important concepts include:

    * Shared responsibility: Which security activities belong to the provider and customer.

    * Data portability: Ability to export data.

    * Data deletion: Handling of information at contract termination.

    * Data location: Where information is stored or processed.

    * Incident notification: How security incidents are reported.

    * Subcontractors: Which third parties may handle information.

\- Apartment analogy

* MSA = Overall lease.

* SLA = Specific service commitments.

* Cloud agreement = Detailed terms governing use and shared responsibilities.

\- Agreements may overlap; an SLA can form part of an MSA or cloud agreement.

### Part 12: Quick-Revision Bullet Points

* CIA Triad: Confidentiality, Integrity and Availability.

* ISMS: Organization-wide framework for managing information security.

* PPT: People, Process and Technology.

* ISO 27001:2022: Standard specifying ISMS requirements.

* Clauses 4–10: Seven core ISMS requirements clauses.

* Annex A: 93 reference controls organized into four themes.

* Risk assessment: Identify, analyze and evaluate risks.

* Risk treatment: Modify, avoid, share or accept risks.

* SoA: Identifies necessary controls, implementation status and justified exclusions.

* Nonconformity: Failure to fulfill an applicable requirement.

* PDCA: Plan, Do, Check, Act.

* Risk score: Likelihood × Impact in a simple model.

* Inherent risk: Risk before considering relevant controls.

* Residual risk: Risk remaining after considering controls.

* Asset inventory: Record of information assets and related resources.

* Change management: Controlled assessment, authorization and implementation of changes.

* SOC 1: Controls relevant to financial reporting.

* SOC 2: Relevant Trust Services Criteria for a service organization's system.

* SOC 3: General-use report on relevant Trust Services Criteria.

* SOC Type 1: Control design and implementation at a specified date.

* SOC Type 2: Control design and operating effectiveness over a specified period.

* SSAE 18 and SSAE 21: US attestation standards; requirements depend on the engagement.

* Processing integrity: Complete, valid, accurate, timely and authorized processing.

* Bridge letter: Management's update addressing the gap after a prior SOC report period.

* Subservice organization: Third party providing part of a service.

* Carve-out: Relevant subservice controls excluded from the service auditor's examination.

* Inclusive method: Relevant subservice controls included in the examination.

* CUECs: Controls the customer is expected to implement.

* Underlying subject matter: The actual matter being evaluated.

* Subject matter information: Information describing or measuring that matter against criteria.

* MSA: Overall contractual relationship.

* SLA: Measurable service performance commitments.

* Privacy consent: Must meet applicable legal requirements when used as the legal basis for processing.

### Part 13: Study Questions with Model Answers

1\. Explain the CIA Triad.

* Confidentiality prevents unauthorized disclosure.

* Integrity protects against unauthorized or improper changes.

* Availability ensures timely access to information and systems.

2\. What is an ISMS?

\- A structured system of policies, processes, responsibilities and controls for managing information security risks.

3\. Why are People, Process and Technology all important?

* People need appropriate awareness and accountability.

* Processes provide consistent procedures.

* Technology implements technical safeguards.

* Weakness in any pillar can undermine the others.

4\. Differentiate standard, normal and emergency changes.

* Standard: Routine and pre-authorized.

* Normal: Assessed, tested and approved.

* Emergency: Urgent, expedited and subject to appropriate documentation and review.

5\. What is a CUEC?

* A control the service provider expects its customer to implement.

* Example: Configuring MFA and access permissions for a cloud service.

6\. Differentiate SOC Type 1 and Type 2.

* Type 1 evaluates design and implementation at a specified date.

* Type 2 evaluates design and operating effectiveness over a specified period.

7\. Calculate risk for likelihood 4 and impact 5.

* Risk score = 4 × 5 = 20.

* The final classification depends on the organization's risk criteria.

8\. Differentiate inherent risk and residual risk.

* Inherent risk is assessed before considering relevant controls.

* Residual risk remains after considering controls and their effectiveness.

9\. What is a bridge letter?

* A document typically prepared by management to address changes or incidents since the end of the prior SOC report period.

* It does not replace a new independent SOC examination.

10\. Differentiate underlying subject matter and subject matter information.

* Underlying subject matter is the actual system, condition or activity being evaluated.

* Subject matter information is the report, description or measurement about that matter.

Additional practice questions

* Why are Clauses 4–10 central to ISO 27001 certification?

* Why are Annex A controls selected according to risk treatment rather than applied as a universal checklist?

* What is the difference between risk assessment and risk treatment?

* Why does ISO 27001 certification not guarantee that breaches will never occur?

* How does ISO 27001 certification differ from a SOC 2 report?

* Why should organizations test backup restoration?

* What is the difference between a carve-out and an inclusive approach?

* Why can a consent banner be noncompliant even if it has an “Accept All” button?

* How do an MSA and SLA complement each other?

* Why is a risk score of 20 not automatically classified as high under every risk methodology?

### Recommended Study Sequence

* Stage 1 — Fundamentals: CIA Triad, ISMS and People–Process–Technology.

* Stage 2 — ISO 27001: Clauses 4–10, Annex A, risk treatment and SoA.

* Stage 3 — Risk and operations: Risk register, asset inventory and change management.

* Stage 4 — Compliance: Privacy, consent, vendor agreements and shared responsibility.

* Stage 5 — SOC reporting: SOC 1/2/3, Type 1/Type 2, SSAE 18/21, CUECs and bridge letters.

* Stage 6 — Revision: Practice scenario-based questions, compare similar terms and explain the purpose of each control in your own words.

Here is *1-Page Summary* for CISA students – Quick Revision:

### SUMMARY: ISO 27001, Security Compliance, SOC 1, SOC 2

*1. ISO 27001:2022*

- International Standard for *ISMS*. Certifiable, valid 3 years.

- *93 controls* in Annex A – 4 themes: Organizational, People, Physical, Technological.

- Key document: *SoA – Statement of Applicability* – Lists which controls applicable.

- Proves company HAS security management system.

*2. Security Compliance*

- Following laws/standards to protect data – GDPR, PCI-DSS, HIPAA, DORA, RBI Outsourcing, DPDP.

- TPRM needs continuous monitoring, not yearly check.

*3. SOC 1*

- *Focus: MONEY – Financial Reporting [ICFR]*

- Question: Can I trust vendor for my financial statements?

- For: Payroll, Claims, Loan processors.

- Issued under SSAE 18 by CPA firm.

*4. SOC 2*

- *Focus: DATA – Security & Trust*

- Question: Can I trust vendor with my DATA?

- For: Cloud, SaaS, AWS, Data Centers.

- *5 Trust Criteria: Security + Availability + Processing Integrity + Confidentiality + Privacy*

- Always ask for *Type 2 – Unqualified, within 12 months.*[Mandatory]

*5. Key CISA Concepts in SOC 2*

- *CUEC:* Controls YOU must do, otherwise vendor's SOC 2 invalid for you.

- *Carve-out vs Inclusive:* Carve-out = Sub-vendor's controls NOT covered – You need separate SOC 2 of AWS etc.

*6. SOC 1 vs SOC 2 – Final Difference*

- *SOC 1 = Money / ICFR / CFO & External Auditor needs it*

- *SOC 2 = Data / Security / Client & CISO needs it*

*7. ISO 27001 vs SOC 2*

- ISO 27001 = Certification, 3 years, ISO body, 93 controls

- SOC 2 = Attestation, 12 months, CPA firm, 5 Trust Criteria

- Mature company = Has BOTH.

*Memory Trick: SOC 1 = MONEY, SOC 2 = DATA*

www.gmsisuccess.in