SOC

SOC 1

Internal control over financial reporting

What does SOC 2 focus on?

Security, availability, or processing integrity of a system or the confidentiality or privacy of the information processed by the system.

Who is SOC 2 meant for?

Knowledgeable users.

What is SOC 3?

A report designed for general users who need assurance about the controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy, but lack knowledge.

What type of report is SOC 3?

It is always a type 2 report.

Type 1

as of a specified date

Type 2

throughout a specified period

Trust services criteria 1: confidentiality

Information is protected

Trust services criteria 2: availability

Information and systems are available for operation and use

Trust services criteria 3: processing integrity

system processing is complete, valid, accurate, timely, and authorized

Trust services criteria 4: privacy

Personal information is collected, used, retained, disclosed, and disposed of

Trust services criteria 5: security

information and systems are protected against unauthorized access

How does the service auditor reach their opinion for a SOC engagement?

By determining if the description of the controls is presented fairly, controls are designed effectively, and the controls operate as intended

Inclusive method

Subservice will need to provide a separate management assertion letter for the primary service auditor's report

Carve out method

nature of the service provided, types of controls along with applicable trust service criteria that are intended to be met by the complementary subservice organization controls (CSOCs)

Contents of SOC 1 report

Management's description of the system Management's assertions Independent service auditor report Auditor's test of controls and results of tests (type 2 only)

Contents of SOC 2 report

Management's description of the system Management's Assertion Independent service auditor's report Auditor's test of controls and results of tests (type 2 only)

When does a SOC report included the Auditor's test of controls and results of tests

Type 2 only

If a SOC 2 Type 2 report identified deviations, what information also needs to be included?

Number of items tested, number and nature of deviations, causative factors (optional)

CUECs for SOC 1 reports

Any relevant CUECs that ensure control objectives are met should be descripted in the system desription

CUECs for SOC 2 reports

System descriptions should also include relevant CUECs and a statement that user entities are responsible for those controls

Qualified opinion

except for the effects of the matter(s) giving rise to the modification, the description is presented in accordance with the description criteria

Adverse opinion

Description misstatements are material and pervasive or deficiencies in the design or operation of controls are material and pervasive

Disclaimer of opinion

Auditor does not express an opinion