System and Organization Controls (SOC) reports communicate independent examination results concerning specified controls. Planning begins with the information users need, the subject matter, and the date or period requiring assurance.
A service organization provides services to other entities, called user entities. The service auditor performs the independent examination; management remains responsible for describing the system, establishing controls, and evaluating its own assertions.
The intended users of SOC reports determine the necessary scope and detail. A payroll processor may need different reports for financial reporting and service-security questions.
The report families address different information needs.
SOC 1 follows the service-organization examination requirements within the attestation standards. SOC 2 and SOC 3 follow the applicable common concepts and assertion-based examination requirements and use the Trust Services Criteria.
SOC for Cybersecurity reports can address an entity that provides no outsourced services. Their purpose concerns the enterprise cybersecurity program, rather than an automatic extension of an existing SOC 2 system boundary.
In a Type 1 engagement, the service auditor evaluates the description and suitability of control design at a specified date.
Common mistakes
- Availability confused with accuracy. An accessible system may still process incomplete or incorrect records.
- Grouping mistaken for criterion. The nine common groupings contain multiple criteria; counting groupings does not count individual requirements.
- Description treated as testing. A statement that reviews occur does not establish that reviews actually occurred during the period.
Bottom line
- SOC report selection follows intended users, subject matter, distribution needs, and the requested date or period.
- Type 1 addresses description and design at a date; Type 2 adds operating effectiveness throughout a period, and SOC 3 has no Type 1 form.
- The Trust Services Criteria combine COSO-aligned and supplemental common criteria with additional criteria for selected categories.
- Description criteria evaluate management's system explanation, while control criteria evaluate design and applicable operating effectiveness.
Exam shortcut
The requested outcome identifies the report family: financial-reporting controls, detailed system assurance, general distribution, or an enterprise cybersecurity program. Timing words determine the evidence needed. “Designed as of” and “operated throughout” require different evidence even when every other fact remains unchanged. For outsourcing, identifying the control's performer precedes determining the method's effect. Provider monitoring remains relevant under either method.
The full lesson (about 9,039 words, 60 min read) adds 4 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- III.A1
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.