System and Organization Controls (SOC) Engagements

System and Organization Controls (SOC) reports

• SOC 1: user entities' financial reporting; management's control objectives; restricted.
• SOC 2: Trust Services Criteria; restricted. SOC 3: general use. SOC 2+: extra frameworks.
• Type 1: description + design at a date. Type 2: + operating effectiveness over a period, with tests and results.

Trust Services Criteria

Security (common criteria, always) · availability · processing integrity · confidentiality · privacy.

Report parts

Auditor's opinion · management's assertion · system description · tests and results (Type 2) · optional other information.

Subservice organizations

Carve-out (excluded; complementary subservice organization controls listed) vs inclusive (tested; their own assertion).

Opinions

Material description or control failure → qualified; pervasive → adverse; scope limitation or no assertion → qualified, disclaimer, or withdraw.

Exam traps

• A SOC 3 report has no tests and results, so a user auditor can't rely on it to assess control risk.
• Exceptions in a Type 2 report don't automatically mean a qualified opinion — users still need to judge their effect.
• If user entities don't perform the complementary user entity controls, the service organization's controls may not meet their objectives.