Attestation & System and Organization Controls (SOC) Engagements

Why this topic matters

Attestation engagements report on subject matter other than historical financial statements — internal controls at a service organization, compliance with laws, prospective information, sustainability metrics. They follow the Statements on Standards for Attestation Engagements (SSAEs). Auditing and Attestation (AUD) tests the three types of attestation engagements, the elements of an engagement, and System and Organization Controls (SOC) reports.

Elements of an attestation engagement

• Subject matter — what is measured (for example, controls at a service organization, greenhouse gas emissions, compliance with a contract).
• Criteria — the benchmarks used to measure or evaluate the subject matter. They must be suitable (relevant, objective, measurable, complete) and available to intended users.
• Responsible party — usually management; the engaging party hires the practitioner and may be the same.
• Assertion — a statement by the responsible party about the subject matter measured against the criteria.

Preconditions include independence (for all attestation engagements), a responsible party that accepts responsibility, suitable and available criteria, and access to evidence.

Three types of attestation engagements

	Examination	Review	Agreed-upon procedures
Assurance	Reasonable	Limited	None — findings only
Output	Opinion	Conclusion ("not aware of any material modifications")	Procedures and findings
Procedures	Risk assessment, tests of controls where relevant, substantive procedures — like an audit	Primarily inquiry and analytical procedures	Specific procedures the engaging party acknowledges as appropriate
Written assertion	Requested; if the engaging party is also the responsible party and refuses, withdraw (unless a direct examination under SSAE No. 21, where the practitioner measures the subject matter itself)	Requested; refusal by an engaging responsible party → withdraw	Not required
Independence	Required	Required	Required

Reports may be restricted when criteria are available only to specified parties or are suitable only for them.

System and Organization Controls (SOC) reports

Report	Subject matter	Users
SOC 1	Controls at a service organization relevant to user entities' internal control over financial reporting (for example, payroll processing)	Restricted — user entities and their auditors
SOC 2	Controls relevant to the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy	Restricted — knowledgeable users (customers, regulators, business partners)
SOC 3	Same criteria as SOC 2, without the detailed description of tests and results	General use — can be posted on a website
SOC for Cybersecurity	An entity-wide cybersecurity risk management program	General use
SOC for Supply Chain	Controls over producing, manufacturing, or distributing goods	Customers and business partners

Type 1 versus Type 2

• Type 1: fairness of management's description of the system and the suitability of design of controls as of a point in time.
• Type 2: everything in Type 1 plus the operating effectiveness of controls throughout a period (usually 6–12 months), with a description of tests and results.
• A user auditor needs a Type 2 report to reduce assessed control risk.

SOC 2 Trust Services Criteria

• Security (the common criteria) is included in every SOC 2 engagement.
• Availability, processing integrity, confidentiality, and privacy are included as the service organization chooses.
• The common criteria are organized using the Committee of Sponsoring Organizations of the Treadway Commission (COSO) internal control components.

Subservice organizations and user controls

• Inclusive method: the subservice organization's relevant controls are included in the description and testing.
• Carve-out method: the subservice organization's controls are excluded; the description identifies the services it performs and any complementary subservice organization controls expected.
• Complementary user entity controls (CUECs): controls the service organization assumes its customers will have (for example, reviewing payroll reports). The user entity and its auditor must evaluate them.

Using a SOC 1 report as a user auditor

• Evaluate the service auditor's professional competence and independence.
• Check that the report covers the relevant period (a gap requires bridge letters or additional procedures), the relevant controls, and the relevant subservice organizations.
• Consider exceptions noted by the service auditor and test CUECs.
• Do not refer to the service auditor in the user auditor's report.

Other attestation subjects

Subject	Key rules
Prospective financial information	Forecasts (expected results) may be for general use; projections (results under hypothetical assumptions) are restricted to parties negotiating directly with the entity. Practitioners may examine, compile, or apply agreed-upon procedures; an examination opinion covers whether the assumptions provide a reasonable basis. Reports warn that results may differ.
Pro forma financial information	Shows the effect of a transaction as if it occurred earlier; examination or review; the historical statements must have been audited or reviewed
Compliance attestation	Compliance with laws, regulations, contracts, or grants; examination or agreed-upon procedures (reviews are not permitted for compliance)
Sustainability and greenhouse gas information	Examination (reasonable assurance) or review (limited assurance) of metrics against suitable criteria

How it is tested

• Match an engagement type to its assurance, report form, and assertion requirements.
• Choose the SOC report and type a user needs.
• Apply the carve-out and inclusive methods and CUECs.
• Know the restrictions on projections and compliance engagements.