SOC Engagements in CPA ISC: Planning, Performing, and Using SOC Reports

System and Organization Controls (SOC) engagement

An attestation engagement where a CPA reports on controls at a service organization providing services to user entities.

user auditor

The financial statement auditor of a user entity who assesses risk related to outsourced services.

SOC 1

Report focusing on controls relevant to user entities’ internal control over financial reporting (ICFR).

SOC 2

Report focusing on the Trust Services Criteria (TSC) including Security, Availability, Confidentiality, and Processing Integrity.

SOC 3

General-use report covering the same subject matter as SOC 2 but with much less detail.

Type 1 report

A report assessing whether controls are suitably designed as of a specified date.

Type 2 report

A report assessing whether controls are suitably designed and operating effectively over a specified period.

service organization

An entity that provides services to user entities and is subject to a SOC engagement.

subservice organization

A third party used by a service organization to perform part of the service being provided.

complementary user entity controls (CUECs)

Controls that the user entity implements for the service organization’s controls to achieve objectives.

AICPA

American Institute of CPAs, which sets standards for SOC engagements.

SSAE

Statements on Standards for Attestation Engagements, under which SOC reports are issued.

Trust Services Criteria (TSC)

Criteria for evaluating controls in SOC 2 reports, including Security, Availability, Confidentiality, Processing Integrity, and Privacy.

system description

A comprehensive narrative prepared by management detailing the system being evaluated in a SOC report.

management's written assertion

A declaration by management regarding the fairness of the system description and controls.

restricted use report

A SOC report intended for a specific class of users, typically more knowledgeable about the subject matter.

general use report

A SOC report suitable for distribution to a broader audience without restrictions.

scope limitations

Restrictions on the auditor's ability to obtain sufficient appropriate evidence, affecting the type of opinion issued.

modified opinion

An opinion that indicates there were significant issues in the audit, such as scope limitations or ineffective controls.

design effectiveness

The capability of a control to prevent, detect, or correct errors when followed as intended.

operating effectiveness

The consistent application of a control as designed throughout the reporting period.

CUEC example in payroll processing

Authorization of employee rate changes and review of payroll registers by the user entity.

carve-out method

An approach used when a SOC report excludes the controls of a subservice organization from its scope.

inclusive method

An approach where the controls of a subservice organization are included within the service organization's SOC report.

audit risk

The risk that an auditor may issue an inappropriate opinion on financial statements.

Type 1 vs Type 2 relevance

Type 1 assesses design effectiveness at a point in time, Type 2 assesses both design and operating effectiveness over a period.

service auditor

The CPA who plans and performs the SOC engagement and issues the SOC report.

data center security assurances

Not guaranteed in carved-out SOC reports; separate SOC reports may be required for subservice organizations.

complementary subservice organization controls (CSOCs)

Controls at the subservice organization necessary for the effectiveness of the service organization’s controls.

SOC 1 criteria

Control objectives relevant to financial reporting for SOC 1 engagements.

SOC 2 criteria

Trust Services Criteria (TSC) utilized for evaluating controls in SOC 2 reports.

risk management use of SOC 2

SOC 2 reports are commonly used for assessing risks associated with third-party vendors.

CUEC responsibilities

Responsibilities that user entities must meet to ensure effective operation of service organization controls.

evidence-gathering methods

Inquiry, observation, inspection, and reperformance methods used by auditors to assess operating effectiveness.

financial statement audit reliance

The level of confidence user auditors have in the controls reported by service organizations through SOC reports.

independence in SOC engagements

The obligation of auditors to remain neutral and uninvolved in management activities of the service organization.

written representations from management

Confirmations by management affirming key responsibilities and the completeness of provided information.

common mistakes in SOC understanding

Confusing SOC 1 and SOC 2 criteria, assuming Type 1 indicates operating effectiveness, or overlooking CUECs.

SOC report components

Management's description, management's assertion, service auditor's opinion, and in Type 2, control tests and results.

integrated audit approach

Combining IT and financial reporting assessments during SOC audits to address user entity needs.

Trust Services Criteria inclusion

Security is always required while Availability, Confidentiality, Processing Integrity, and Privacy are optional based on the service organization's choice.

boundaries of the system

Defines what processes, applications, locations, and teams are included in the SOC report's evaluation.

roles in SOC engagements

Service organization, management, service auditor, user entities, and user auditors all have distinct responsibilities in the SOC process.

SOC engagement purpose

To provide independent assurance about the service organization's controls relative to agreed criteria.

authentication controls in IT

Methods ensuring only authorized users have access to systems and data, relevant in SOC reports.