# Control Environment — CC 1.1–1.5

Per-criterion audit guidance for governance, ethics, organizational structure, and accountability.

## CC 1.1 — Ethics and integrity

**Priority**: Medium | **NIST**: PS-1, PS-3, PS-6 | **ISO**: A.6.1, A.6.2, A.6.4

Auditors assess whether the organization sets the tone from the top on integrity and ethical behavior. This isn't about having a perfect culture — it's about demonstrating that leadership has established expectations, communicated them, and created mechanisms for accountability. For startups, the code of conduct and background checks are the minimum viable evidence.

**What auditors test**:
- Code of conduct or ethics policy exists and is signed by all employees (including founders)
- Background checks completed for employees with access to sensitive data — verify checks completed before start date
- Whistleblower or ethics reporting mechanism exists (even a simple anonymous form counts)
- Management demonstrates ethical tone: policies apply equally to leadership and staff
- Sample 3-5 employee files for signed acknowledgments

**Evidence to prepare**:
- Code of conduct or ethics policy (with effective date predating audit period)
- Signed acknowledgment records for all employees (export from HRIS or document management)
- Background check completion records (date of check vs. start date)
- Whistleblower policy or ethics reporting channel documentation
- Employee handbook section covering ethical standards and consequences

**Startup pitfalls**:
- Code of conduct doesn't exist or was written after the audit period started
- Background checks skipped for early employees and contractors
- "We're too small for a whistleblower policy" — auditors expect one regardless of size

---

## CC 1.2 — Board oversight

**Priority**: Medium | **NIST**: PM-1, PM-2 | **ISO**: C.5.1, C.5.3

Auditors verify that governance bodies (board, advisory board, or management committee) exercise oversight of the internal control environment. For startups without a formal board, the equivalent is documented management reviews where leadership evaluates security posture and risk.

**What auditors test**:
- Board or management committee meets at regular intervals (at least quarterly)
- Meeting minutes include discussion of security, risk, or compliance topics
- Board members have relevant expertise or access to advisors for security/technology oversight
- Management reporting: leadership receives periodic updates on security metrics, incidents, and compliance status
- Charter or terms of reference define the governance body's responsibilities for internal controls

**Evidence to prepare**:
- Board or management meeting minutes from the audit period (at least quarterly)
- Board charter or management review charter covering security oversight responsibilities
- Security/compliance status reports presented to leadership
- Board member biographies showing relevant expertise
- Evidence of independent oversight (external advisors, audit committee, or independent board members)

**Startup pitfalls**:
- No documented board meetings — investor updates don't count unless they cover security governance
- Management reviews happen informally but are never documented with minutes
- Security is never a board/management agenda item — only discussed reactively after incidents

---

## CC 1.3 — Organizational structure

**Priority**: Medium | **NIST**: PM-2 | **ISO**: C.5.3

Auditors verify that the organization has a defined structure with clear lines of authority and reporting for security-related functions. Someone must be accountable for the security program — even if it's a shared responsibility in a small team, it should be documented.

**What auditors test**:
- Organizational chart showing reporting lines for security function
- Named security owner (CISO, VP Engineering, CTO, or designated security lead)
- Reporting line: security function reports to management with authority to act
- Segregation of duties: key security functions (access management, change approval, incident response) are not concentrated in one person without compensating controls
- Job descriptions include security responsibilities where applicable

**Evidence to prepare**:
- Current organizational chart (with date)
- Security program charter or policy naming the responsible individual
- Job descriptions for security-relevant roles (even if security is one of several responsibilities)
- RACI matrix for key security processes (access management, incident response, change control)

---

## CC 1.4 — Competence commitment

**Priority**: High | **NIST**: AT-2, PS-3 | **ISO**: A.6.1, A.6.3

Auditors verify that the organization hires competent people and invests in keeping their skills current through training. Security awareness training is the most commonly tested element — expect auditors to check completion rates and content relevance.

**What auditors test**:
- Security awareness training completed by all employees within audit period (100% completion expected)
- Training content covers: phishing recognition, password hygiene, incident reporting, acceptable use
- New hire training completed within first 30 days of employment
- Role-specific training for security-critical positions (e.g., secure coding for developers)
- Training records are maintained with dates, participants, and completion status

**Evidence to prepare**:
- Training completion records with dates (export from LMS, Google Classroom, or training platform)
- Training content outline or syllabus covering security topics
- Phishing simulation results (if applicable — demonstrates training effectiveness)
- New hire onboarding checklist showing security training step with deadline
- Certificates or completion records for role-specific training

**Startup pitfalls**:
- No formal training — "we talk about security in all-hands" isn't documented or verifiable
- Training completed by 80% of employees — the 20% gap is a finding
- Training content is generic and doesn't cover the organization's specific policies
- No tracking mechanism — "everyone did it" without records is unverifiable

---

## CC 1.5 — Accountability

**Priority**: Medium | **NIST**: PS-3, PS-4 | **ISO**: A.6.4, A.6.5

Auditors verify that individuals are held accountable for their internal control responsibilities. This connects ethics (CC 1.1) with consequences — if someone violates security policy, there's a defined process for addressing it. Accountability also means performance evaluations include security responsibilities.

**What auditors test**:
- Disciplinary process exists for security policy violations (documented in employee handbook)
- The process is communicated to all employees (typically at onboarding and via training)
- Performance evaluations include security-related responsibilities for relevant roles
- Consequences are applied consistently — leadership is not exempt
- Termination procedures include security considerations (access revocation, NDA reminders)

**Evidence to prepare**:
- Employee handbook section covering disciplinary process for policy violations
- Signed policy acknowledgment forms (proving employees know the consequences)
- Performance review template showing security-related criteria (for security-relevant roles)
- Termination checklist with security steps (access revocation, equipment return, NDA reminder)
- Exit interview template covering ongoing confidentiality obligations
