ISC - S4

Describe a SOC1 engagement for a service org

• ICFR

• report restricted to management, user entities, and auditors

Describe a SOC2 engagement for a service org

• 5 TSC

• Report for those with sufficient knowledge and understanding of service org…

Describe a SOC3 engagement for a service org

• Like SOC2, it does not include a description of the system or the auditor’s test of controls.

Type 1 SOC report

Report on

• fairness of the presentation of management’s description

• suitability of the design of controls

• (specified date)

Type 2 SOC report

Report on

• fairness of the presentation of management’s description

• suitability of the design of controls

• Effectiveness of controls

• (specified period)

5 TSC

CAPPS

• Confidentiality

• Availability

• Processing Integrity

• Privacy

• Security

5 Components of COSO framework

CRIME

• Control Environment

• Risk Assessment

• Information & Communication

• Monitoring

• Existing Control Activities

4 key components of a SOC report

1. Management’s description of the system

2. Management’s assertion

3. independent service auditor’s report

4. Auditor’s tests of controls and results of tests

CSOCs (complementary subservice organization controls) vs CUECs (complementary user entity controls)

CSOCs

• controls a subservice org must execute in order for a service orgs controls to function effectively

CUECs

• controls a user entity must employ for the service org’s controls to function

(the service org relies on vendors or client for controls to work)

Management uses either the carve-out or inclusive method to report on what subject matter?

CSOCs