SOC Reporting

Question 1

Under the inclusive method under a SOC 2 Type 2 report, what other info would be included?

Answer 1

The Subservice organization assertion

Question 2

Under the carve-out method, what would the report say?

Answer 2

The report would say that the objectives and controls were not evaluated

Question 3

AT-C 320 outlines the reporting standards that are for what type of examination?

Answer 3

SOC 1 examination

Question 4

What should an independent service auditor’s report include?

Answer 4

• The report should include a statement that the service auditor didn’t evaluate the suitability or operating effectiveness of the complementary user entity controls.
• This statement makes users of the report aware that although complemenetary controls are listed in management’s description of the service organiaztion’s system, the service auditor did not perform any procedures to determine if there are misstatements

Question 5

What are complementary user entity controls?

Answer 5

• They are controls provided by a 3rd party service provider to help achieve the vendor’s control activities.
• CUECs can be thought of as a laundry list of controls/activities that customers of a service provider must have in place to receive services.
• Example of CUEC: A cloud-based file-sharing program, like Dropbox, may require user entities to remove a former employee’s corporate account from the file-sharing program.

Question 6

A SOC 2 Type 2 report lists

Answer 6

• The service auditor’s tests of control and results.
• The auditor includes a table showing controls tested, nature of tests performed, and whether they were performed on a sample or the total population.
• Service auditors should describe the NUMBER and NATURE of all exceptions, including the number of items tested, AS MATERIALITY DOES NOT APPLY TO DISCLOSING TESTING EXCEPTIONS

Question 7

If any exceptions in a test are identified, what happens?

Answer 7

• The report should include the number of exceptions found, sample or population testing size, and an explanation of the nature of each exception.
• Example: An exception was found in 5 of the 25 systems sampled

Question 8

AT-C 205 states that a CPA’s role in an assertion-based exam is to:

Answer 8

• Obtain reasonable assurance about the subject matter being free from material misstatement.
• Express an opinion in a written report about:
  1) The subject matter being in accordance with the criteria in all material respects
  2) The responsible party’s assertion is fairly stated in all material respects

Question 9

What is an unmodified (unqualified) opinion?

Answer 9

• It is an opinion that is ok only when the service auditor didn’t find any material misstatements in management’s description of the service organization’s system, the suitability of controls, and operating effectiveness of controls (type 2 report ONLY for operating effectiveness)

Question 10

What is a modified opinion?

Answer 10

• It is AKA Qualified, Adverse, Disclaimer.
• It is an opinion that is appropriate when the effect of the following is material:
  1) The service auditor cannot obtain sufficient appropriate evidence to conclude that the subject matter is in accordance with criteria
  2) Based on evidence obtained, the service auditor believes the subject matter is NOT in accordance with the criteria

Question 11

What is pervasiveness?

Answer 11

It is the extent to which the findings affect the subject matter

Question 12

What is a disclaimer of opinion?

Answer 12

• It happens when no opinion is expressed.
• It is appropriate when the service auditor is unable to obtain sufficient appropriate evidence and the potential effects could be both material and pervasive.

Question 13

What is a qualified opinion (modified)?

Answer 13

It is appropriate when scope limitations (problems with obtaining evidence) can cause undetected material misstatements BUT they are not pervasive

Question 14

What kind of assurance do SOC examinations provide?

Answer 14

Reasonable assurance
NOT absolute assurance

Question 15

What is reasonable assurance?

Answer 15

It is a higher level of assurance.
However, service auditors cannot guarantee that procedures will uncover every material misstatement.

Question 16

What should a service auditor’s report include?

Answer 16

It should include a paragraph that discusses the inherent limitations in the effectiveness of any system of internal controls

Question 17

What kind of attestation engagements are SOC exams?

Answer 17

Assertion-based attestation engagements

Question 18

In a SOC 2 Type 2 report, a statement that says that management believes that complementary user entity controls OPERATED EFFECTIVELY THROUGHOUT THE PERIOD would appear in which section of the report?

Answer 18

Management’s Assertion

Question 19

In a SOC 2 examination, management’s description of the service organiation’s system should provide:

Answer 19

A list/table of relevant complementary user entity controls (CUEC)

Question 20

What is an example of a service organization?

Answer 20

Employee benefit plans, payroll processors, insurance claims processors

Question 21

What are controls that are performed by carved out subservice organizations called?

Answer 21

Complementary subservice organiation controls

Question 22

When a service organization’s management chooses the carve-out method for a subservice organization during a SOC 1, 2, or 3 engagement

Answer 22

The service auditor’s report must state that the procedures did not extend to the Complementary Subservice Organization Controls (CSOC)

Question 23

The date of the service auditor’s report should be

Answer 23

The date on which the auditor has completed documentation and review of the evidence and obtained the finalized management’s description and assertion, AND the signed representation letter

Question 24

Type 1 report

Answer 24

• Exam scope: As of a specified day
• Service auditor evaluates: Description of system and suitability of the design of the controls
• Service auditor must state: that the engagement team did not perform tests of controls and does not express an opinion on the operating effectiveness of controls

Question 25

Type 2 report

Answer 25

• Exam scope: Throughout a period
• Service auditor evaluates: Description of system, suitability of design of controls
  AND OPERATING EFFECTIVENESS OF CONTROLS

Question 26

Scope limitation

Answer 26

• This occurs when a service auditor cannot get sufficient evidence because management refused to allow document inspection, for example
• If the scope limitation is material but not pervasive, then a qualified opinion may be appropriate
• A disclaimer of opinion is necessary if the scope limitation is both material and pervasive