ISC- S4

1 examples of the types of services provided by service organizations

2 SOC3 for service organizations

3 SOC for cybersecurity, SOC for supply chain engagement

4 types of SOC reports

5 SOC3 always issued as type 2 report

6 trust services criteria

7 control environment

8 risk assessment

9 control activities

10 information and communication

11 monitoring activities

12 alignment of trust services criteria and COSO principles

13 additional criteria for availability (A series)

14 additional criteria for processing integrity (PI series)

15 additional criteria for confidentiality (c series)

16 additional criteria for privacy (P series)

17 unmodified (unqualfied) opinion

18 modifications to the service auditor's opinion

19 types of modified opinions

20 summary of modified opinions chart

21 subservice organizations- inclusive method and carve-out method

22 summary of management assertions by engagement type chart

23 overview of the carve-out and inclusive methods

24 carve-out method

25 inclusive method

26 management may determine carve-out method is most practical in the following circumstances

27 impact of the carve-out and inclusive methods in a soc report

28 complementary user entity controls (CUECs)

29 key differences between CSOC and CUEC

30 qualified opinion-soc1 engagement, soc2 engagement

31 qualfied opinion SOC1 report chart

32 qualified opinion due to material missstatements SOC2 report- service auditor's responsibilties, qualfiied opinion

33 elements of service auditor's SOC2 report-qualified opinion due to scope limitations

34 adverse opinion SOC1 report

35 adverse opinion SOC1 report continued

36 adverse opinion SOC2 report-service auditor's responsibilities

37 adverse opinion SOC2 report

38 disclaimer of opinion

39 report paragraphs desribing matters giving rise to modification

40 controls that are not suitably designed

41 materiality in a SOC1 engagement

42 materiality in a SOC2 engagement

43 misstatements in a SOC engagement

44 subsequent events likely to affect a SOC report

45 subsequent events unlikely to affect a SOC report

46 impact of subsequent events on the SOC report

47 content of written representations

48 content of written representations continued

Trust Services Criteria SOC 2