ISC, Information Systems and Controls

Sources for Planning and Performing a SOC Engagement

Last reviewed 2026-10-08

The standards and authorities behind PocketCPA's ISC lessons on Planning and Performing a SOC Engagement. The topic rests on SSAE No. 18 as amended (AT-C 105, AT-C 320) and SSAE No. 21 (AT-C 205, Assertion-Based Examination Engagements), the AICPA Trust Services Criteria (TSP section 100, 2017 criteria with revised points of focus - 2022), and the SOC 2 description criteria (DC section 200, 2018 description criteria with revised implementation guidance - 2022).

About this topic

A company can hand a process to an outside provider, but it cannot hand over responsibility for it, and its auditor still has to know that the provider's controls work. ISC.III.A covers the front half of a System and Organization Controls engagement: which report and standard apply, who the parties are, what management must provide, how the system is scoped, and how the service auditor understands and tests controls.

A service organization is a provider whose services affect its user entities' data or financial reporting. Payroll processors, claims administrators, cloud hosts, data centers and SaaS platforms are the recurring fact patterns. The user entity has outsourced the process but not the responsibility for it. So somebody has to give the user, and the user's auditor, evidence about controls that sit inside a building they will never visit. A SOC report is that evidence, and an attestation examination produces it, not an audit.

Key points

A SOC 1 engagement reports on controls relevant to user entities' financial reporting (ICFR); SOC 2 reports on the trust services criteria.
Type 1 reports on design and implementation at a point in time; Type 2 reports on operating effectiveness over a period.
The service auditor's opinion covers the description, the suitability of design, and (for Type 2) operating effectiveness.
Complementary user entity controls (CUECs) are controls the service organization assumes the user has in place.

What the lessons cover

SOC report types
Standards governing SOC engagements
Subject matter: SOC 1 versus SOC 2
Trust Services Criteria and the common criteria
Engagement acceptance and the parties
Management's responsibilities and assertion
System description and description criteria
Subservice organizations
Complementary user entity controls and risk
Understanding and testing controls
Type 1 versus Type 2
Scoping decisions and the gaps a clean opinion leaves open
Confusion pairs the exam builds questions from

Authoritative references

Where these requirements sit in the literature.

AT-C 105 carries the concepts common to all attestation engagements. It sits above both SOC families and is the general layer, which makes it the wrong answer to "which section applies specifically to this engagement" and the right answer to "which section states the concepts common to all of them". SSAE No. 21 amended it, principally for new terminology.
AT-C 205 is the examination section, currently titled Assertion-Based Examination Engagements. A SOC 2 is performed under it, using the Trust Services Criteria as the control criteria and the description criteria in DC section 200 for the description. SSAE No. 21 superseded and retitled it in order to differentiate it from AT-C 206, effective for practitioners' reports dated on or after June 15, 2022, with early implementation permitted.
AT-C 206, Direct Examination Engagements, was added by SSAE No. 21. It exists for examinations in which no responsible party has measured or evaluated the subject matter first, so no assertion is required. A SOC report is not a direct examination: management asserts and the practitioner examines that assertion.
AT-C 320 applies specifically to SOC 1: controls at a service organization relevant to user entities' internal control over financial reporting. It was not changed by SSAE No. 21, and SOC 1 continues under SSAE No. 18, as amended. In a SOC 1, management specifies the control objectives, tied to the financial-reporting assertions its user entities rely on.
TSP section 100, the Trust Services Criteria (2017 criteria with revised points of focus - 2022), supplies the control criteria for a SOC 2. Five categories: security, availability, processing integrity, confidentiality and privacy. Security is required in every SOC 2 and is evaluated through the common criteria, CC1 through CC9, which also underpin the other categories. The 2022 revision changed points of focus, not the criteria.
DC section 200, the description criteria (2018 description criteria with revised implementation guidance - 2022), governs the description of the system in a SOC 2. The description must be complete, accurate and not misleading. Management prepares it; the service auditor evaluates it. The 2022 revision changed implementation guidance, not the criteria.
The COSO Internal Control - Integrated Framework supplies the components on which the SOC 2 common criteria are organized: control environment, communication and information, risk assessment, monitoring and control activities. To those components the criteria add logical and physical access, system operations, change management and risk mitigation. COSO organizes the common criteria; it is not the criteria a SOC 2's controls are evaluated against.
AU-C 320 is named here only to be excluded. It is the GAAS materiality standard for a financial statement audit and has no application to a SOC engagement. It appears in distractor sets purely because its number matches AT-C 320's.
SSAE No. 18 and the AT-C sections generally are the framework answer whenever a question asks what kind of engagement a SOC report is. It is an attestation examination: not a GAAS (AU-C) audit, not a SSARS review, not an agreed-upon procedures engagement, and not unregulated consulting.

Exam trap. The layering questions are answered by specificity, not by correctness in the abstract. AT-C 105 is a true statement about every SOC engagement and is still the wrong answer when the question asks which section applies specifically to a SOC 1. The word "specifically" is doing all the work, and it is always in the stem.

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.