ISC, Information Systems and Controls
Sources for Reporting on a SOC Engagement
Last reviewed
The standards and authorities behind PocketCPA's ISC lessons on Reporting on a SOC Engagement. The topic rests on SSAE No. 18 as amended (AT-C 320, the SOC 1 section) and SSAE No. 21 (AT-C 205, Assertion-Based Examination Engagements), the AICPA description criteria (DC section 200) and the 2017 Trust Services Criteria, the AICPA SOC guides, and AU-C 402 (user auditor considerations).
About this topic
A SOC engagement ends in a report, and the exam tests how to read one. ISC.III.B covers that output: what the report contains, how Type 1 and Type 2 differ, how control deviations affect the opinion, the kinds of opinion, who may use the report, and how a user auditor relies on it.
Get those four right and the rest follows: the report type, the opinion, the distribution rule, and the user auditor's response. Get one wrong and the fact pattern routes cleanly to a wrong answer, which is exactly how the distractors in this section are built.
Key points
- The SOC report opinion can be unqualified, qualified (material but not pervasive), or adverse (material and pervasive).
- A Type 2 report includes detailed testing results describing the controls tested and the results of each test.
- The report is restricted to existing customers and prospective customers for SOC 2; SOC 3 is the general-use version.
- A bridge letter covers the gap between the SOC report period end and the user entity's reporting date.
What the lessons cover
- Structure of a SOC report
- Management's assertion versus the service auditor's opinion
- Type 1 versus Type 2 reports
- Tests of controls and results
- Deviations and their effect on the opinion
- Opinion types
- Restricted use versus general use
- Complementary user entity controls in the report
- Report dating, the period, and bridge letters
- The user auditor's use of a SOC 1 report
- SOC 1 versus SOC 2: subject matter, criteria, and control objectives
- Description criteria (DC 200) and the trust services criteria
- The scope boundary: what the opinion covers and what it does not
- The standards behind a SOC report
Authoritative references
- SSAE No. 18, as amended, and AT-C 320, the attestation standard for SOC 1 reports on controls at a service organization relevant to user entities' internal control over financial reporting.
- SSAE No. 21 and AT-C 205, Assertion-Based Examination Engagements, the standard under which a SOC 2 or SOC 3 is performed, and AT-C 206, Direct Examination Engagements, which the same Statement added and which a SOC report does not use.
- DC section 200, the AICPA description criteria for the description of a service organization's system in a SOC 2 report.
- The 2017 Trust Services Criteria (TSP section 100), the control criteria for a SOC 2.
- AU-C 402, Audit Considerations Relating to an Entity Using a Service Organization, the user auditor's responsibilities in using a SOC 1 report.
- The AICPA SOC guides, the practice guidance on the structure of a SOC report, the opinion types, the restricted use language, and the bridge letter.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.