Criterion CC3.2The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

SOC 2, the trust services criteria, CC3.2

Criterion text: 2017 Trust Services Criteria (with revised points of focus, 2022). © 2022 Association of International Certified Professional Accountants. All rights reserved. COSO principles © 2019 Committee of Sponsoring Organizations of the Treadway Commission (COSO). All rights reserved. Reproduced from copies of AICPA's published text; check it against AICPA's own before relying on it.