ISC - 4

S4 · System and Organization Controls (SOC) Engagements

What is a user entity versus a service organization?

• User entity: Company that outsources a function.
• Service organization: Outside company that performs it.

Example: A retailer (user entity) hires a payroll processor (service organization).

What is a SOC engagement?

SOC - Systems and Organizational Controls

An independent examination of controls at a service organization, resulting in a SOC report that helps third parties rely on those controls.

Example: A cloud provider obtains a SOC report to give customers assurance about its controls.

What are common examples of service organizations?

• Payroll processors

• Cloud hosting providers

• Credit card processors

• IT outsourcing firms

• Fintech services

• Customer support providers

What is the purpose of a SOC 1 report?

Evaluate controls at a service organization relevant to user entities’ internal control over financial reporting (ICFR).

Example: A payroll provider’s controls over payroll calculations affect customers’ financial statements.

Who can use a SOC 1 report?

Restricted use:

• Service organization management
• Existing user entities
• User entities’ independent auditors

Not intended for: Potential customers.

What is the purpose of a SOC 2 report?

Evaluate controls against the applicable Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

Example: A software company has its customer-data security controls examined.

Who is a SOC 2 report intended for?

Specified parties with sufficient knowledge of the service organization, its services, and its system. Management and the service auditor agree on intended users.

Example: A current business customer evaluating a vendor’s security controls.

What is the purpose of a SOC 3 report?

Provide general-use assurance about controls under the Trust Services Criteria, without disclosing the detailed system description or auditor tests/results.

Example: A technology company publicly posts its SOC 3 report.

What is the key difference among SOC 1, SOC 2, and SOC 3?

• SOC 1: Controls relevant to financial reporting; restricted use.
• SOC 2: Trust Services Criteria; detailed report for knowledgeable specified users.
• SOC 3: Trust Services Criteria; general-use, less detailed.

Memory tip: 1 = Financial; 2 = Detailed trust; 3 = Public trust.

What is a Type 1 SOC report?

Assesses the fair presentation of the system description and suitability of control design as of a specific date.

Example: Are access controls suitably designed on December 31?

What is a Type 2 SOC report?

Assesses the system description, control design, and operating effectiveness throughout a specified period.

Example: Did access reviews actually occur every month from January through December?

Which SOC reports can be Type 1 or Type 2?

• SOC 1: Type 1 or Type 2
• SOC 2: Type 1 or Type 2
• SOC 3: Type 2 only

Memory tip: SOC 3 always examines operation over time.

What does CAPPS stand for in the Trust Services Criteria?

• Confidentiality
• Availability
• Processing integrity
• Privacy
• Security

What does the Confidentiality criterion evaluate?

Whether information designated confidential is protected to meet the organization’s objectives.

Example: Restricting access to confidential client contracts.

What does the Availability criterion evaluate?

Whether systems and information are available for use as needed to meet objectives.

Example: A cloud service has backup infrastructure to reduce outages.

What does the Processing Integrity criterion evaluate?

Whether processing is complete, valid, accurate, timely, and authorized.

Example: A payment system processes every approved transaction once, correctly, and on time.

What does the Privacy criterion evaluate?

Whether personal information is collected, used, retained, disclosed, and disposed of in accordance with objectives.

Example: A website deletes personal data under its retention policy.

What does the Security criterion evaluate?

Protection against unauthorized access or disclosure and system damage that could compromise information or systems.

Example: MFA and intrusion monitoring protect customer accounts.

How do Confidentiality and Privacy differ?

• Confidentiality: Protects information designated confidential, whether personal or not.
• Privacy: Governs the lifecycle of personal information.

Example: Trade secrets = confidentiality; customer birthdates = privacy.

How do the COSO framework and Trust Services Criteria relate?

Trust Services Criteria are aligned with COSO’s 17 principles across five internal-control components, with supplemental and category-specific criteria.

What are COSO’s five internal-control components? (CRCIM)

1. Control environment (principles 1–5)

2. Risk assessment (6–9)

3. Control activities (10–12)

4. Information and communication (13–15)

5. Monitoring activities (16–17)

What does a service auditor evaluate before forming a SOC opinion?

• Whether evidence is sufficient and appropriate
• Whether uncorrected misstatements, individually or together, are material

What does an unmodified SOC opinion mean?

In all material respects:

• The system description is fairly presented.

• Controls are suitably designed.

• Type 2 only: Controls operated effectively.

When is a qualified SOC opinion appropriate?

A material but not pervasive issue exists; the opinion is essentially “except for” the identified matter.

Example: One important control failed, but other control areas remain reliable.

When is an adverse SOC opinion appropriate?

The auditor identifies material and pervasive description misstatements or control deficiencies.

Example: Critical security controls are broadly ineffective across the system.

When is a disclaimer of opinion appropriate?

The auditor cannot obtain sufficient appropriate evidence, and possible effects could be material and pervasive.

Example: Essential audit logs for much of the review period are unavailable.

How do you distinguish qualified, adverse, and disclaimer opinions?

• Qualified: Material, not pervasive issue (or evidence limitation).
• Adverse: Auditor found a material and pervasive problem.
• Disclaimer: Auditor lacks evidence, with potentially material and pervasive effects.

Memory tip: Found widespread failure = adverse; cannot tell = disclaimer.

What are the main components of a detailed SOC report?

• Management’s system description
• Management’s written assertion
• Independent service auditor’s report
• Auditor’s tests of controls and results (Type 2)

Who prepares the system description in a SOC engagement?

Service organization management, not the service auditor.

Example: The payroll company describes its processing systems and controls; the auditor evaluates that description.

What should a SOC 1 system description help readers understand?

How the service organization’s processing affects user entities’ financial statements and related risk of material misstatement.

Includes services, procedures, systems, subservice organizations, controls, and CUECs.

What should a SOC 2 system description help readers understand?

The system, processing and flow of data, risks and controls, service commitments, relevant Trust Services Criteria, CUECs, subservice organizations, and relevant incidents.

What does management’s written assertion cover in SOC 1 and SOC 2?

Management asserts that:

• Its system description is fairly presented.
• Controls are suitably designed.
• Type 2 only: Controls operated effectively.

What does management assert in a SOC 3 engagement?

That controls operated effectively to provide reasonable assurance that service commitments and system requirements were achieved, including system boundaries and principal commitments/requirements.

What information about tests of controls appears in a SOC 2 Type 2 report?

• Controls tested and nature of testing
• Whether all or selected items were tested
• If deviations exist: number of items tested, number and nature of deviations
• Optional: Causative factors

Does a Type 1 report include auditor tests of operating effectiveness?

No. Type 1 covers control design as of a date, not operation over a period.

Contrast: Type 2 includes operating-effectiveness testing and results.

What information is described in a cybersecurity risk management program?

Includes the entity’s:

• Business and information at risk
• Cybersecurity objectives and inherent-risk factors
• Governance and risk assessment
• Communications and monitoring
• Cybersecurity control processes

What is a subservice organization?

A vendor used by a service organization whose services and controls are necessary or relevant to the SOC engagement’s objectives/criteria.

Example: A payroll processor relies on a cloud host to store payroll records.

What are complementary subservice organization controls (CSOCs)?

Controls at a subservice organization necessary, together with the service organization’s controls, to meet relevant objectives or commitments.

Example: The cloud host must physically secure the servers used by a payroll provider.

What is the carve-out method?

The service organization excludes the subservice organization’s controls from the engagement scope while describing the services, expected CSOCs, and how it monitors the subservice provider.

Example: A software provider excludes its cloud host’s controls from its SOC audit.

What is the inclusive method?

The service organization includes relevant subservice organization controls in the system description and SOC engagement scope.

Example: A provider’s SOC examination includes applicable controls at its outsourced data center.

Who decides whether to use carve-out or inclusive treatment?

Service organization management.

A service organization may use carve-out for one vendor and inclusive for another.

What is the easiest way to remember carve-out vs. inclusive?

• Carve-out = OUT: Subservice controls are outside the examination scope.
• Inclusive = IN: Relevant subservice controls are inside the scope.

What are complementary user entity controls (CUECs)?

Controls the customer/user entity must implement, alongside service organization controls, for objectives or commitments to be achieved.

Example: A payroll provider processes only payroll changes approved by the customer; the customer must approve them properly.

How do CUECs differ from CSOCs?

• CUECs: Controls performed by the user entity/customer.
• CSOCs: Controls performed by the subservice organization/vendor.

Memory tip: U = User; S = Subservice.

What are common examples of CUECs?

• Security monitoring
• Authorizing user access
• Physical access controls
• Encrypting financial data
• Managing environment changes

Example: A customer promptly removes terminated employees’ access.

Does a SOC 2 auditor evaluate whether CUECs are operating effectively?

No, not as part of the service organization’s SOC 2 examination. The report identifies relevant CUECs and states that user entities are responsible for them.

Example: A vendor’s auditor does not test every customer’s employee access approvals.

What must the SOC opinion acknowledge about CUECs and CSOCs?

When applicable, the opinion explains that those complementary controls are necessary to achieve the stated objectives or service commitments/system requirements.

When does a SOC 2 qualified opinion apply to an evidence limitation?

When the auditor lacks sufficient evidence and the possible effects could be material but not pervasive.

Contrast: Possible effects both material and pervasive → disclaimer.

What report changes accompany a qualified or adverse SOC 2 opinion?

• Amend the opinion paragraph.
• Add a separate paragraph explaining the modification.
• Amend the service auditor responsibilities section.

What is the purpose of the basis-for-modification paragraph?

Explain the matter that caused the SOC opinion to be modified.

Example: Identify a control that management described as implemented but that was never put into use.

What must the service auditor establish before accepting a SOC engagement?

An understanding with management of management’s and the auditor’s responsibilities, including engagement terms and management’s written assertion.

What are the service auditor’s main planning responsibilities for any SOC engagement?

• Decide whether to accept or continue the engagement.
• Agree on engagement terms.
• Obtain understanding about management’s written assertion.

What is an additional planning focus in a SOC 1 engagement?

• Assess risk of material misstatement.
• Understand the service organization’s system.
• Evaluate suitability of system description criteria.

What is an additional planning focus in SOC 2 and SOC 3 engagements?

Develop an overall engagement strategy (scope, timing, direction) and perform risk assessment procedures related to the system and relevant Trust Services Criteria.

From whom must a service auditor be independent?

• Service organization/responsible party: Yes.
• Each user entity/customer: Not required.
• Subservice organization management under inclusive method: Yes, because it is a responsible party.

How is materiality in SOC 1 evaluated?

Focuses on the system description and controls, not the user entities’ financial statements.

• Qualitative: Missing or distorted important system information
• Type 2 quantitative: Tolerable versus observed deviation rates
• Type 2 qualitative: Nature/cause of deviations

How is materiality in SOC 2 evaluated?

Whether misstatements or control deficiencies could reasonably influence report users’ decisions, considering likelihood and magnitude of risks to service commitments/system requirements.

What are the five components of a system for SOC 2 purposes?

• Infrastructure
• Software
• People
• Data
• Procedures

Example: An online banking platform includes servers, applications, staff, customer records, and operating procedures.

What are system boundaries in a SOC engagement?

The specific infrastructure, software, people, procedures, and data included in the system being examined. Boundaries must be clearly described.

Example: A SOC 2 report covers the production cloud platform, not an unrelated internal prototype.

What is a service commitment?

A declaration made by service organization management to customers or others about the service/system.

Example: “Our platform will be available 99.9% of the time.”

What is a system requirement?

A specification for how the system must function to fulfill service commitments, comply with requirements, or achieve objectives.

Example: Automated failover and monitoring are required to support a 99.9% uptime commitment.

How do service commitments differ from system requirements?

• Commitment: What the organization promises.
• Requirement: How the system must function to deliver it.

Example: Promise secure storage → require encryption and access controls.

Who is responsible for achieving and disclosing service commitments and system requirements?

Service organization management. It must disclose principal commitments and requirements clearly enough for SOC 2 users to understand the related controls.

What risks should service organization management assess?

• Internal/external intentional or accidental acts
• Threats and vulnerabilities
• Sensitive data handled by subservice organizations
• Personnel with system access
• Missing necessary CUECs/CSOCs

What is the purpose of the service auditor’s risk assessment?

Identify and assess material misstatement risks and design procedures responsive to those risks.

Type 2 additionally considers: Risk that controls did not operate effectively.

What procedures help the auditor understand a service organization’s system?

• Inquiry of personnel
• Observation of operations
• Inspection of records and agreements
• Reperformance of controls
• Review of regulator/internal auditor/specialist reports (SOC 2)

What fraud and noncompliance risks should a SOC auditor consider?

• Management override of controls
• Misappropriation of assets
• False or misleading records
• Noncompliance with laws or regulations

How should a service auditor respond to assessed risks?

Design overall responses and further procedures whose nature, timing, and extent address the assessed risks, obtaining enough evidence to reduce attestation risk to an acceptably low level.

What does a SOC 1 auditor assess when reviewing management’s system description?

Whether it fairly describes:

• Reasonable control objectives
• Controls actually implemented
• Relevant CUECs/CSOCs
• Subservice organizations and carve-out/inclusive treatment

When is a SOC 1 system description not fairly presented?

When it claims controls operate that do not, or omits relevant controls that are poorly designed or ineffective.

Example: The report claims all payroll changes require approval, but approval is not performed.

What must a SOC 2 system description do to meet description criteria?

• Describe the system actually implemented.
• Cover each relevant description criterion.
• Avoid material omissions or distortions affecting report users’ decisions.

What are examples of a misleading SOC 2 description?

• Claims IT components exist when they do not.
• Claims controls are implemented when they are not performed.
• Includes statements that cannot be objectively evaluated.

What should an auditor do if management’s system description is misleading?

Ask management to amend the description and evaluate whether additional disclosures are needed.

Example: A company claims continuous monitoring but only reviews alerts quarterly.

What is tested in a SOC 2 Type 2 engagement beyond the system description?

Whether controls were suitably designed and operated effectively during the specified period.

Example: Inspect monthly access-review evidence across the year.

What evidence may support SOC 2 tests of controls?

• Inquiry
• Document inspection
• Walk-throughs
• System documentation
• Evidence of how attacks, vulnerabilities, and emerging threats were addressed

What does evidence about operating effectiveness need to show?

How, how consistently, and by whom or in what manner controls were applied.

Example: Logs show who approved access requests and when, throughout the review period.

How should a SOC 2 auditor evaluate control deviations?

Consider quantitative and qualitative results, investigate the nature and cause of deviations, and consider corroborating and contradictory evidence from internal and external sources.

What happens if the auditor finds material SOC 2 description or control problems?

The auditor should modify the opinion when material description misstatements, design deficiencies, or Type 2 operating-effectiveness deviations warrant it.

What is a subsequent event in a SOC engagement?

An event after the engagement period but before the auditor’s report date that could significantly affect the system description, controls, or management’s assertion.

Example: A serious breach occurs after year-end but before the SOC report is issued.

What must the auditor do about subsequent events before issuing the report?

• Inquire of management.

• Obtain evidence about significant events.

• Request appropriate disclosure.

• If management refuses a necessary disclosure, consider modifying the report or withdrawing.

What is a subsequently discovered fact?

A fact learned after the auditor’s report date that might have changed the report if known earlier.

Key rule: The auditor need not keep performing procedures after the report date, but must respond appropriately to significant newly discovered facts.

Why are written management representations required?

They confirm management’s assertions and responsibilities, document continuing representations, and reduce misunderstandings between management and the auditor.

As of what date should written management representations be made?

As of the date of the issued SOC report, covering the subject matter and periods addressed by the auditor’s opinion.

What key statements belong in management’s written representations?

Management confirms:

• Responsibility for the subject matter, assertion, and criteria

• All relevant information/access provided

• Contradictory information and regulator communications disclosed

• Material subsequent events disclosed

• Uncorrected misstatements believed immaterial

• SOC 1: Significant estimation assumptions are reasonable

How do management’s assertion and written representations differ?

• Assertion: Management’s formal claim about the system description and controls.
• Written representations: Broader confirmations of responsibilities, completeness, disclosures, and information supplied.

Example: “Controls operated effectively” is an assertion; “we disclosed all known exceptions” i

When evaluating controls using the Trust Services Criteria (TSC), which categories require only the Common Criteria and which require additional criteria?

✅ Common Criteria (CC1-CC9) apply to ALL 5 Trust Services Categories

✅ Additional criteria apply ONLY to:

• Availability

• Processing Integrity

• Confidentiality

• Privacy

❌ Security has NO additional criteria.