Attestation & System and Organization Controls (SOC) Engagements

Attestation (Statements on Standards for Attestation Engagements (SSAEs))

• Elements: subject matter, suitable and available criteria, responsible party, assertion.
• Examination = reasonable assurance, opinion. Review = limited, conclusion. Agreed-upon procedures = findings.
• Independence required for all three.
• Assertion refused by engaging responsible party → withdraw (except direct examinations).

System and Organization Controls (SOC) reports

• SOC 1: controls over user entities' financial reporting; restricted.
• SOC 2: Trust Services Criteria — security always + availability, processing integrity, confidentiality, privacy; restricted.
• SOC 3: general use.
• Type 1: design at a point in time. Type 2: + operating effectiveness over a period.

Subservice organizations

Inclusive (controls included) vs carve-out (excluded). Complementary user entity controls (CUECs) must be tested by users.

Other

• Forecast: general use. Projection: restricted.
• Compliance: examination or agreed-upon procedures — no review.

Exam traps

• A Type 1 report gives no evidence of operating effectiveness, so a user auditor can't use it to assess control risk below maximum.
• No review is allowed on prospective financial information either — examination or agreed-upon procedures only.
• Carve-out method: the user auditor must get evidence about the subservice organization's controls some other way.
• A bridge letter from the service organization's management covers the gap between the report period end and the user's year end.