System and Organization Controls (SOC) reports communicate an independent service auditor's examination conclusions about defined systems and controls. Selecting the appropriate form begins with the assurance purpose, applicable criteria, reporting date or period, and examination boundaries.
The report families address different subjects.
- SOC 1 concerns controls relevant to user entities' internal control over financial reporting (ICFR). The service-organization examination standards govern reporting against the description criteria and financial-reporting control objectives identified in...
- SOC 2® concerns controls supporting the service organization's commitments and system requirements under the applicable Trust Services Criteria. The common and assertion-based attestation standards govern this examination.
- For SOC 2, the description criteria evaluate whether management fairly presents the system. The Trust Services Criteria evaluate control design and, when included, operating effectiveness.
SOC 2® report scope identifies the applicable categories: security, availability, processing integrity, confidentiality, and privacy. Security's common criteria support every engagement; additional categories follow the system's commitments, requirements, and selected scope.
The selected categories limit the report's conclusions.
Common mistakes
- Responsibility transferred by label. Calling a failed service control a CUEC does not transfer the service organization's contractual responsibility to customers.
- Provider report changes the method. Possessing Cedar Hosting's report does not expand Brookmere's carve-out examination boundary.
- Sample result becomes universal. No exceptions among 15 selected additions does not establish that all 60 additions were examined.
Bottom line
- SOC 1 addresses user entities' financial-reporting control objectives; SOC 2 addresses the described system using description criteria and applicable Trust Services Criteria.
- Type 1 addresses description and design at a date; Type 2 adds period operating effectiveness and detailed tests and results.
- CUECs establish necessary user-side assumptions that the service auditor does not examine at each customer.
- Carve-out excludes provider controls from examination while describing dependencies; inclusive reporting includes relevant provider controls, assertions, testing, and opinion coverage.
Exam shortcut
Identify purpose first, then date or period, selected criteria, and subservice method. These cues determine the report form before any opinion judgment. Underline evidence language: “could not obtain” points to possible effects; authenticated records showing nonperformance point to established effects. Evaluate alternatives before treating evidence as insufficient. Apply materiality and pervasiveness to that evidence branch. Do not rank opinions on a single severity ladder.
The full lesson (about 6,246 words, 42 min read) adds 3 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- III.B1
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.