CPA Exam AUD: SOC Reports (SOC 1, SOC 2, SOC 3) Explained

SOC Reports Explained: Essential Knowledge for the CPA AUD Exam

System and Organization Controls (SOC) reports are a growing area of importance for CPAs and are tested on the AUD exam. These reports provide assurance about controls at a service organization that are relevant to user entities' financial reporting or other operational objectives. SOC engagements are performed under the AICPA's attestation standards, specifically AT-C Section 320 (Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting) for SOC 1 reports and AT-C Section 205 for SOC 2 and SOC 3 reports.

Why SOC Reports Matter

Many entities outsource functions to service organizations, such as payroll processing, cloud computing, data hosting, and transaction processing. When a user entity's financial statements are affected by controls at a service organization, the user entity's auditor needs assurance about those controls. SOC reports provide this assurance. The user auditor considers the SOC report when assessing risk and designing audit procedures related to the outsourced functions.

SOC 1 Reports

SOC 1 reports address controls at a service organization that are relevant to user entities' internal control over financial reporting (ICFR). These reports are performed under AT-C 320 and are the successor to the former SAS 70 reports. SOC 1 reports are restricted-use reports, meaning they are intended only for the service organization, user entities, and user entity auditors.

SOC 1 reports come in two types. A Type I report covers the description of the service organization's system and the suitability of the design of controls as of a specified date. A Type II report covers the same elements as Type I plus the operating effectiveness of those controls over a specified period of time (typically six months to one year). Type II reports are generally more useful because they provide evidence that controls operated effectively throughout a period, not just that they were designed properly at a point in time.

SOC 2 Reports

SOC 2 reports address controls at a service organization relevant to security, availability, processing integrity, confidentiality, and privacy. These are known as the Trust Services Criteria (TSC). SOC 2 reports are performed under AT-C 205 (Examination Engagements) and are restricted-use reports.

The Trust Services Criteria are:

Security: The system is protected against unauthorized access, both physical and logical (this criterion is always included in a SOC 2 report).
Availability: The system is available for operation and use as committed or agreed.
Processing Integrity: System processing is complete, valid, accurate, timely, and authorized.
Confidentiality: Information designated as confidential is protected as committed or agreed.
Privacy: Personal information is collected, used, retained, disclosed, and disposed of in conformity with the entity's privacy notice and criteria.

Like SOC 1 reports, SOC 2 reports have Type I (design of controls at a point in time) and Type II (design and operating effectiveness over a period) versions.

SOC 3 Reports

SOC 3 reports address the same Trust Services Criteria as SOC 2 reports but are designed for general use. They can be freely distributed and posted on the service organization's website. SOC 3 reports contain the auditor's opinion but do not include the detailed description of the system or the detailed testing results found in SOC 2 reports. They are essentially a seal of assurance that the service organization has been examined and meets the applicable trust services criteria.

Key Differences Among SOC Reports

The primary differences relate to purpose, audience, and content:

SOC 1: Focused on ICFR; restricted use; includes detailed system description and test results (Type II).
SOC 2: Focused on Trust Services Criteria; restricted use; includes detailed system description and test results (Type II).
SOC 3: Focused on Trust Services Criteria; general use; contains the opinion without detailed descriptions or test results.

The Service Auditor's Responsibilities

The service auditor must obtain sufficient appropriate evidence to support the opinion. For Type I reports, this means evaluating the fairness of the description of the system and the suitability of the design of controls. For Type II reports, this also means testing the operating effectiveness of controls over the specified period. The service auditor's report includes a description of the tests performed and the results of those tests. If a control did not operate effectively, the service auditor describes the deviation.

Complementary User Entity Controls

SOC reports often identify complementary user entity controls (CUECs), which are controls that the service organization assumes the user entity has implemented. For the user auditor to rely on the SOC report, the user entity must have those complementary controls in place and operating effectively. The user auditor is responsible for evaluating the design and operating effectiveness of CUECs at the user entity.

Exam Tips for SOC Reports

SOC 1 is for ICFR; SOC 2 and SOC 3 are for Trust Services Criteria.
SOC 1 and SOC 2 are restricted use; SOC 3 is general use.
Type I covers design at a point in time; Type II covers design and operating effectiveness over a period.
Security is always included in SOC 2 and SOC 3 reports.
The user auditor must evaluate complementary user entity controls at the user entity.