System and Organization Controls (SOC) Engagements

Why this topic matters

Area III of Information Systems and Controls (ISC) — Considerations for System and Organization Controls (SOC) Engagements — is 15–25% of the section. It tests how a service auditor plans, performs, and reports on SOC 1 and SOC 2 examinations under the Statements on Standards for Attestation Engagements (SSAEs), and how the report is structured.

The SOC family

Report	Subject	Criteria	Distribution
SOC 1	Controls relevant to user entities' internal control over financial reporting	Control objectives specified by management	Restricted to management, user entities, and their auditors
SOC 2	Controls relevant to security, availability, processing integrity, confidentiality, or privacy	Trust Services Criteria (and description criteria)	Restricted to knowledgeable users
SOC 3	Same as SOC 2, summarized	Trust Services Criteria	General use
SOC for Cybersecurity	An entity's cybersecurity risk management program	Description criteria + control criteria (such as the Trust Services Criteria)	General use
SOC for Supply Chain	Controls over producing, manufacturing, or distributing goods	Trust Services Criteria	Restricted

A SOC 2+ report adds criteria from other frameworks (for example, health information requirements) to a SOC 2 examination.

Type 1 versus Type 2

• Type 1: the fairness of the description and the suitability of design of controls, as of a specified date.
• Type 2: the same, plus the operating effectiveness of controls throughout a specified period (typically 6–12 months), with a description of tests and results.

The Trust Services Criteria

• Security — the common criteria, required in every SOC 2 — protection against unauthorized access, disclosure, and damage. They are organized using the Committee of Sponsoring Organizations of the Treadway Commission (COSO) components: control environment, communication and information, risk assessment, monitoring, and control activities, plus logical and physical access, system operations, change management, and risk mitigation.
• Availability — systems are available for operation as committed (capacity, backup, recovery).
• Processing integrity — processing is complete, valid, accurate, timely, and authorized.
• Confidentiality — confidential information is protected as committed.
• Privacy — personal information is collected, used, retained, disclosed, and disposed of as committed.

Points of focus illustrate each criterion but are not all required.

Parts of a SOC report

1. Service auditor's report (opinion).
2. Management's assertion — management's written statement about the description and controls (required).
3. Management's description of the system — services, infrastructure, software, people, procedures, data, principal service commitments and system requirements (SOC 2), relevant aspects of the control environment, control objectives or criteria and related controls, complementary user entity controls, and subservice organizations.
4. For Type 2: description of the tests of controls and results.
5. Optional: other information provided by the service organization (not covered by the opinion).

Performing the engagement

• Acceptance: independence; management's agreement to provide an assertion and access; suitable criteria; a reasonable period of coverage.
• Planning: understand the system, assess risks that the description is not fairly presented and that controls are not suitably designed or operating effectively; set materiality (considering qualitative factors).
• Evidence: evaluate the description against the description criteria; test design (inquiry plus observation and inspection, walkthroughs); for Type 2, test operating effectiveness across the whole period (inquiry combined with inspection, observation, and reperformance; sampling).
• Deviations: investigate their nature and cause; determine whether they mean the control objective or criterion was not achieved.
• Using internal audit: the service auditor may use internal auditors' work or direct assistance within limits, and must describe that use in the tests section.
• Written representations from management, and consideration of subsequent events up to the report date.

Subservice organizations

• Carve-out method: the subservice organization's controls are excluded from the description and testing; the description identifies the services it performs and the complementary subservice organization controls expected.
• Inclusive method: its relevant controls are included and tested; it must provide its own written assertion.

Modified opinions

Situation	Opinion
The description is not fairly presented, or controls are not suitably designed, or (Type 2) not operating effectively — material but not pervasive	Qualified — the opinion paragraph identifies the affected control objectives or criteria
The same, but pervasive	Adverse
Scope limitation — unable to obtain sufficient evidence, or management refuses to provide an assertion or representations	Qualified or disclaimer (or withdraw)

Deviations that don't prevent achievement of a control objective are described in the tests section but don't modify the opinion.

How it is tested

• Choose the SOC report and type for a user's need.
• Identify required elements of management's description and the report.
• Apply carve-out versus inclusive treatment.
• Decide the opinion when deviations or description misstatements are found.