ISc 4

Examples of services provided by a service organization

Payroll processing, claims processing, data hosting, cloud computing, data center operations, transaction processing, investment servicing, and IT outsourcing are common services provided by a service organization.

SOC 1 Engagement

An examination engagement that reports on controls at a service organization that are relevant to user entities' internal control over financial reporting (ICFR).

SOC 2 Engagement

An examination engagement that reports on controls at a service organization relevant to one or more Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

SOC 3 Engagement

An examination engagement covering the same subject matter as a SOC 2 report but intended for general public distribution. It provides a short-form report without detailed descriptions of controls or testing.

Type 1 SOC Report

A report that expresses an opinion on the fairness of management's description of the system and the suitability of the design of controls as of a specified date.

Type 2 SOC Report

A report that expresses an opinion on the fairness of management's description of the system, the suitability of the design of controls, and the operating effectiveness of those controls throughout a specified period.

Five Trust Services Categories

Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Five Components of the COSO Framework

Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

Subject Matter of a SOC Engagement

The service auditor forms an opinion on management's assertion regarding the fairness of the system description and the design and, when applicable, the operating effectiveness of controls.

Focus of the Service Auditor's Opinion

The opinion addresses whether management's description of the system is fairly presented, whether controls are suitably designed, and for Type 2 engagements, whether controls operated effectively throughout the examination period.

Types of Service Auditor Opinions in a SOC Engagement

Unmodified opinion, Qualified opinion, Adverse opinion, and Disclaimer of opinion.

Four Key Components of a SOC Report

Management's assertion, the independent service auditor's report, management's system description, and the description of tests of controls and results of testing (Type 2 only).

Management's Responsibility in a SOC 1 Engagement

Management is responsible for preparing the system description, identifying the control objectives, designing and implementing controls, and providing a written assertion regarding the fairness of the description and the suitability of the controls.

Management's Responsibility in a SOC 2 Engagement

Management is responsible for preparing the system description, identifying applicable Trust Services Criteria, designing and implementing controls, and providing a written assertion regarding the fairness of the description and the effectiveness of controls, when applicable.

Elements Included in the Independent Service Auditor's SOC 1 Report

Title, addressee, identification of the system and subject matter, management's responsibilities, service auditor's responsibilities, scope of the engagement, inherent limitations of controls, opinion, signature, city and state of the auditor, and report date.

Elements Included in the Independent Service Auditor's SOC 2 Report

Title, addressee, identification of the system and applicable Trust Services Criteria, management's responsibilities, service auditor's responsibilities, scope of the engagement, inherent limitations of controls, opinion, signature, city and state of the auditor, and report date.

Subservice Organization (SOC 1)

A vendor used by a service organization is considered a subservice organization when the services it performs are likely to be relevant to user entities' internal control over financial reporting (ICFR).

Subservice Organization (SOC 2 and SOC 3)

A vendor used by a service organization is considered a subservice organization when the services it performs are likely to be relevant to one or more Trust Services Criteria.

Carve-Out Method

A method of reporting in which the service organization's description excludes the controls at the subservice organization. Management identifies the services provided by the subservice organization, but the service auditor does not express an opinion on the subservice organization's controls.

Inclusive Method

A method of reporting in which the service organization's description includes the services and controls of the subservice organization, and the service auditor's opinion covers both organizations' controls.

Complementary User Entity Controls (CUECs)

Controls that management of the service organization assumes will be implemented by user entities to achieve the stated control objectives or Trust Services Criteria.

Examples of Complementary User Entity Controls (CUECs

Examples include restricting user access, reviewing exception reports, reconciling transactions, approving system changes, maintaining strong passwords, and promptly notifying the service organization of unauthorized activity.

Complementary Subservice Organization Controls (CSOCs) vs. Complementary User Entity Controls (CUECs)

CSOCs are controls expected to be implemented by a subservice organization, while CUECs are controls expected to be implemented by the user entity. Both are necessary for the service organization's controls to achieve the stated objectives or criteria.

Modified Opinion in a SOC Report

If the service auditor issues a qualified or adverse opinion, the report must clearly describe the reasons for the modification and identify the specific subject matter affected.

Acceptance of a SOC Engagement

Before accepting the engagement, the service auditor should determine that management acknowledges and accepts responsibility for the subject matter and that the engagement has a reasonable purpose and suitable criteria.

Management Disclosures in a SOC 1 Engagement

Management must disclose any significant changes to the system during the period, relevant incidents, and any other information necessary for users to understand the system and related controls.

Key Difference in Management Responsibilities (SOC 1 vs. SOC 2)

In a SOC 1 engagement, management identifies control objectives relevant to ICFR. In a SOC 2 engagement, management identifies the applicable Trust Services Criteria and prepares the system description accordingly.

Service Auditor Planning Responsibilities (All SOC Engagements)

The service auditor plans the engagement by obtaining an understanding of the system, assessing risks, determining materiality, identifying controls to be tested, and developing an overall audit strategy.

Additional Planning Responsibilities (SOC 1)

The service auditor considers user entities, complementary user entity controls (CUECs), subservice organizations, control objectives, and whether the carve-out or inclusive method is used.

Additional Planning Responsibilities (SOC 2)

The service auditor considers the applicable Trust Services Criteria, system boundaries, risks affecting those criteria, complementary controls, and the suitability of the criteria used by management.

Misstatement Terminology in SOC Engagements

Misstatements related to the system description are referred to as description misstatements, while deficiencies in controls relate to the design or operating effectiveness of controls.

System (SOC 2 Definition)

A system consists of the infrastructure, software, people, procedures, and data used to provide the services identified in management's system description.