SOC Engagement Planning & Fieldwork: What to Think About and Why It Matters (CPA ISC Area III)

Engagement Acceptance

The process of determining whether a SOC engagement is appropriate based on defined criteria and responsibilities.

Management’s Responsibilities

Management must provide a fair presentation of the system description and operate necessary controls.

Suitable Criteria

Objective and measurable standards relevant to user entities' financial reporting or Trust Services Criteria.

Defined Subject Matter

Clear boundaries on what the system includes, such as applications, infrastructure, and data.

Independence

The necessity for auditors to remain unbiased and objective during SOC engagements.

Competence and Resources

The need for auditors to possess the necessary skills and tools to evaluate relevant technologies and controls.

Complementary User Entity Controls (CUECs)

User entity controls that must be in place for certain control objectives to be achieved.

Type 1 SOC Report

Reports on the suitability of the design of controls at a specific point in time.

Type 2 SOC Report

Reports on the design and operating effectiveness of controls over a specified period.

SOC 1

Focuses on controls relevant to user entities’ internal control over financial reporting.

SOC 2

Focuses on controls relevant to the Trust Services Criteria like security and availability.

SOC 3

A general-use version of SOC 2 intended for broader distribution, with less detail.

Inclusive Method

The SOC report includes relevant controls at a subservice organization.

Carve-Out Method

The SOC report excludes the subservice organization’s controls, requiring management to specify complementary controls.

Risk Assessment

The process of identifying where a service organization could fail to meet criteria and how auditors will test for it.

Evidence

Information collected to support the facts and conclusions of the SOC report, must be sufficient and appropriate.

Operating Effectiveness

A measure of whether a control operates as designed over the engagement period.

Design Effectiveness

A measure of whether a control, if it operates as described, can meet the intended objectives.

Monitoring Controls

Controls that provide oversight to ensure other controls operate effectively.

Fieldwork

The phase of a SOC engagement where auditors execute tests and gather evidence.

Management Assertion

A statement made by management regarding the fairness and effectiveness of the system description.

System Description

Management's account detailing how, what, and who is involved in service delivery, including controls.

Exception Evaluation

The assessment of any deviations from expected control operation and their significance.

Testing Plan

A structured approach to evaluate whether controls are effectively designed and operating as intended.

Quality Control in SOC Engagements

Management and oversight practices to ensure all elements of the audit meet established standards.

Documentation Importance

Critical for supporting evidence, understanding of the system, and conclusions drawn during engagements.

Retention of Evidence

The obligation to maintain audit-related evidence for a sufficient time to enable testing and confirmation.

Project Management in Audits

Coordination of tasks, timelines, and responsibilities essential for successful SOC engagements.

Operational Changes Impact

Recognizing that changes in the system during an engagement may require adjusted testing and evidence gathering.

Stakeholder Reliance

The necessity for users of SOC reports to trust that the engagement was conducted and reported on appropriately.