What is Management's assertion (SOC reports)?
In short
In a System and Organization Controls (SOC) engagement, service organization management gives a written assertion that its system description is fairly presented and its controls were suitably designed, and for a Type 2 report, operated effectively.
Key takeaways
- The service auditor's opinion covers the matters in the assertion.
- Without management's assertion, the engagement can't be performed.
- The assertion is included in the SOC report.
Where it's tested
ISC: System and Organization Controls (SOC) Engagements — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A prospective customer asks a SaaS provider for a report on its security controls that the provider can publish openly on its website. Which report is appropriate?