SOC Reports, Controls, and Assurance Flashcards

Flashcards for SOC reports, controls, and assurance based on lecture notes.

SOC 1 Report

Reports on controls at a service organization relevant to user entities' internal control over financial reporting (ICFR).

SOC 1 Report Audience

Restricted to service organization management, user entities, and user auditors only.

SOC 1 Type 1 Report

Reports on the design of controls as of a specific date.

SOC 1 Type 2 Report

Reports on both the design and operating effectiveness of controls over a period.

SOC 2 Report

Evaluates controls related to security, availability, processing integrity, confidentiality, and privacy.

SOC 3 Report

A general use report on trust services criteria that can be freely distributed.

Management’s Assertion

One of the five sections in both SOC 1 and SOC 2 reports.

Auditor’s Report

One of the five sections in both SOC 1 and SOC 2 reports.

System Description

One of the five sections in both SOC 1 and SOC 2 reports.

Auditor’s Tests of Controls

One of the five sections in both SOC 1 and SOC 2 reports.

Other Info from Service Org

One of the five sections in both SOC 1 and SOC 2 reports.

AT-C 320

Focused on reporting on an examination of controls at a service organization relevant to ICFR.

Limited Assurance

A level of assurance that is less than reasonable assurance.

Professional Skepticism

An attitude that includes a questioning mind and a critical assessment of audit evidence.

Internal Auditors' Work in Attestation

Their work may be used by the practitioner if deemed reliable, to gain understanding and gather evidence.

Materiality in SOC Reports

A concept that determines the significance of misstatements or control deficiencies.

Control Objectives

Define what controls aim to achieve.

Control Activities

The actual procedures in place to meet control objectives.

Reasonable Assurance

A high level of assurance that the subject matter is free from material misstatement.

Limited Assurance (Details)

A moderate level of assurance; the practitioner concludes that no material modifications are needed based on procedures performed. (comes from a review)

Positive Expression

An explicit statement that the subject matter conforms with criteria, typically used in reasonable assurance engagements.

Negative Expression

A statement that nothing came to the practitioner's attention to indicate material misstatement, used in limited assurance engagements.

SOC Report with Reasonable Assurance

SOC 1 and SOC 2 reports usually provide reasonable assurance, especially in Type 2 engagements.

SOC 3 Report

For general use, publicly available, and does not contain detailed system or control test descriptions.