Intro to SOC Engagements Flashcards
What are the 5 Trust Services Categories?
Security, Availability, Processing Integrity, Confidentiality, and Privacy
Who are the intended users of SOC 2 reports?
- SOC 2 reports contain sensitive and complex information
- Restricted to users that have sufficient knowledge about the services organizations, the services it provides, and the systems it uses.
-Typically this includes organizations with direct relationships with the company - auditors, business partners and their auditors, prospective user entities, and regulators. - NOT the general public!
What are the AICPA SOC Suite of Services
SOC for service organizations
SOC for cybersecurity
SOC for supply chain
What does SOC stand for?
System & Organization Controls
What are the 3 types of SOC for service organizations engagements?
SOC 1. SOC 2, SOC 3
What is a SOC for Cybersecurity?
An entity’s cybersecurity risk management program.
What is a SOC for Supply Chain?
System-level controls at an entity that produces, manufactures, or distributes products.
What is the purpose of the AICPA’s Statements on Standards for Attestation Engagements (SSAE Nos. 18, 20, 21)?
They are the standards that are used to conduct attestation engagements for the SOC Suite of Services.
What are the relevant attestation standards for the AICPA’s Statements on Standards for Attestation Engagements
AT-C 105, ATC-205, and AT-320 (specific to SOC 1 and may be helpful in other type of SOC engagements)
What is the primary intention of the SOC for Service Organization report?
Give report users info to understand the service orgs system and controls.
AND
Get an independent CPA’s opinion about whether the service org has:
1. Completely and accurately described their system and controls based on criteria.
2. Suitably designed their controls based on criteria.
3. When included in the engagement, designed controls that operate effectively.
What is the objective of SOC 1 reports?
To provide assurance about controls relevant to user entities’ internal control over financial reporting (ICFR). e.g., a report on Oracle as a subservice org to my company. User orgs and Auditors use SOC 1 reports in a financial statement audit. e., Deloitte.
Type 1 - at a point in time
Type 2 - over a period
Who is responsible for understanding the service organization’s system and how it impacts the user organizations?
The user auditor
e.g. Deloitte
What is the most practical report for a user auditor to obtain evidence about the services provides and that controls are suitably designed, implemented, and operated effectively?
SOC 1 Type 2
SOC 1 - Control Objectives
Type 2 - Over a period
What are the 3 characteristics of a SOC 1 examination?
Responsible Party - Service organization
Subject Matter - Management’s description of the service orgs system and controls relevant to user entities’ internal control over financial reporting.
Suitable Criteria - Description criteria and control criteria listed in AT-C Section 320.
What are the 5 definitions from ATC - 320 that apply to SOC 1 enagagements?
- Management assertions
- Management’s description of the system
- Service organization’s system
- Control Objectives
- Controls at service organization - relevant to user entities’ internal control over financial reporting.
What are the types of SOC engagements?
SOC1 - Type 1 & 2, SOC2 - Type 1 & 2, and SOC3
Why are there Type 1 & Type 2 engagements?
There is a difference on the subject matter of management’s assertions
SOC 1 - provides assurance about controls relevant to user entties internal controls over financial reporting
SOC1 - provides info to user entities and their financial statement auditors
SOC 1 - Suitable criteria for controls is management assertions, NOT trust services criteria.
Type 1 - As of a Specific Day
Type 2 - Throughout a Period
Who are the intended users of SOC 2 reports?
- SOC 2 reports contain sensitive and complex information
- Restricted to users that have sufficient knowledge about the services organizations, the services it provides, and the systems it uses.
- Typically this includes organizations with direct relationships with the company - auditors, business partners and their auditors, prospective user entities, and regulators.
- NOT the general public!
What is the purpose of a SOC 2 Engagement/Report?
SOC 2® reports help users understand how the service organization’s system and controls achieve its principal service commitments. Must include security category. Others are optional
What is the purpose of SOC 3 Engagements?
- Purpose is to provide assurance about controls relevant to security, availability, processing integrity, confidentiality, or privacy.
- General Use Report
- Public is Intended User
-Prepared only after SOC2 Type 2 engagement completed. - Contains less info then SOC2 (need less expertise to understand) so distribute freely to GP
- Management makes NO specific assertion about the design of controls
- A SOC3 is ALWAYS throughout a period and NOT as of a specified date.
- Not a restricted report
- AT-C section 105 and 205 professional standards apply
What are Trust Services Criteria?
(TSC) address the relevant aspects of a cybersecurity program (i.e., trust services categories of information processed by an entity’s systems). These criteria make up the framework for measuring the subject matter of SOC for Cybersecurity
SOC 2 Engagement
Includes managements description of the service orgs systems and related controls
What is management’s assertion for a SOC1 Type 1 examination?
- As of a SPECIFIED DATE - Mgmts description of the system, written description is a fair representation of the systems, mgmts assertion that controls were suitably designed, report expressing an opinion on managements description on the system and the suitability of controls.
- Management makes NO specific assertion about the operating effectively of controls in a Type 1 report, only does this in a Type 2
What is management’s description of the service organizations system and controls relevant to security, availability, processing integrity, confidentiality, or privacy?
Subject Matter
How do supplemental trust services criteria expand on COSO Internal Control Framework? (CRIME)
As part of the Control Activities - Bases controls on thorough policies and procedures.
What is the primary purpose of the additional criteria in the TSC?
To assess controls related to specific trust services categories that are not covered by common and supplemental criteria.
Why did the AICPA develop the trust service criteria (TSC)?
To align and extend the principles of the COSO Internal Control - Integrated Framework (CRIME). Mgmnt and CPA use the criteria to evaluate controls related to the TSC - security, availability, processing integrity, confidentiality, or privacy.
Which SOC Report is intended for general use?
SOC3 - can be shared publicly
Which SOC Reports are restricted reports?
SOC1 and SOC2
