SOC Reporting

Question 1

What are the four elements of a SOC engagement?

Answer 1

1. Mgmt’s Description of System
2. Mgmt’s Assertion
3. SOC Report (includes a reference to mgmt’s assertion)
4. Test of Controls Detail

Question 2

What are the key elements of a SOC report?

Answer 2

1. Title / Addressee / Signatures / Date
2. Scope
3. Service Organization Responsibilities
4. Subservice Organization Responsibilities (if inclusive method)
5. Service Auditor’s Responsibilities
6. Inherit Limitations
7. Description of Tests of Controls (Type 2 only)
8. Other Matter (Type 1 only - explaining no test of controls)
9. Opinion
10. Restricted Use (All except SOC 3)

Question 3

In which 4 areas of a SOC engagement would mention of Complementary User Entity Controls (CUEC) be found?

Answer 3

1. Management’s Description of the System: CUECs are identified and described as controls user entities must implement.
2. Management’s Assertion: Management asserts the description (including CUECs) is fairly presented.
3. Service Auditor’s Report (Opinion and Scope): Opinion assumes CUECs operate effectively; scope states auditor did not test them.
4. Auditor’s Tests of Controls and Results: No testing or results related to CUECs are included (outside auditor’s scope).

Question 4

In which 4 areas of a SOC engagement would mention of Complementary Subservice Organization Controls (CSOCs) be found?

Answer 4

1. Management’s Description of the System: CSOCs are described as controls at subservice organizations necessary for achieving control objectives.
2. Management’s Assertion: Management asserts whether CSOCs are included or carved out and fairly presented in the description.
3. Service Auditor’s Report (Scope and Opinion): Scope identifies SSOs and method used; opinion references CSOCs and clarifies auditor’s procedures related to them.
4. Auditor’s Tests of Controls and Results: For inclusive method, auditor tests CSOCs; for carve-out, CSOCs are excluded and not tested or reported on.

Question 5

Are SOC 1 and SOC 2 reports provided to potential users of the entity’s services?

Answer 5

SOC 1 and SOC 2 reports are restricted to specified users—current customers, their auditors, or parties with detailed knowledge. They are not for potential users.

Only SOC 3 reports are general-use and can be shared with potential or broad audiences.

Question 6

What is an Explanation of Matter paragraph and when is it used?

Answer 6

A separate paragraph added to an auditor’s report to clearly describe specific issues or circumstances that affect the report and result in a modified opinion.

Qualified and Adverse opinion:
Added as a distinct paragraph before the opinion paragraph in the opinion section to explain the reasons for the qualification.

Disclaimer of opinion:
The explanation is included in the Service Auditor’s Responsibilities section, because the auditor is not expressing an opinion.

Question 7

What is the difference between a SOC 2 Type 2 and Type 3 (aka SOC 3) audit?

Answer 7

SOC 3 is like a SOC 2 Type 2 except:

• No detailed system description
• No tests of controls or results included
• General use (unrestricted)
• NO detailed system description
• NO description of tests of controls
• NO Results of tests of controls

Question 8

Do CUECs and services provided by a subservice organization has to be provided in Type 1 engagements?

Answer 8

YES

Both Complementary User Entity Controls (CUECs) and services provided by subservice organizations must be included in the system description for ALL SOC reports (including Type 1 SOC engagements).

Question 9

In a SOC engagement, what the auditor is using the help of the service organization’s internal auditors, should the auditor report make mention of the internal auditor? If so, what should be disclosed?

Answer 9

YES.

In the Description of Tests of Controls section, both the internal audit’s testing and the service auditor’s procedures over that work should be noted (confirming no exceptions were noted if applicable).

Question 10

Is the management of a service organization required to perform a full description of the system in Type 1 SOC engagement?

Answer 10

YES

Management must include a full description of their system—covering both automated and manual procedures—regardless of whether the SOC report is Type 1 or Type 2.