Download Presentation - Plante Moran

SOC – Types of Engagements
SOC engagements are designed to meet the needs of user entities and other
stakeholders by providing service organizations with criteria for describing their
systems, criteria for evaluating the suitability of design and operating effectiveness of
the service organization’s controls, and an independent CPA’s opinion on the
description of the system and the design and operating effectiveness of the service
organization’s controls.
There are three SOC report options:
SOC 1 reports are performed in accordance with the Statement of Standards for
Attestation Engagements (SSAE 16) and focus solely on controls at the service
organization that are relevant to the audit of a user’s financial statements.
SOC 2 reports are performed under Attestation Standards (AT) Section 101 “Attest
Engagements”, and are based on the AICPA’s Trust Services Principles and Criteria.
These reports address one or more of the following key system attributes: security,
availability, processing integrity, confidentiality, and privacy.
There are
two types of
reports for
both SOC 1
and SOC 2
examination
s. A Type 1
and Type 2
SOC 3 reports use the same Trust Services Principles and Criteria as SOC 2. Like SOC
2, SOC 3 reports can address one or more of the five Trust Services Principles and
Criteria. SOC 3 reports differ from SOC 2 reports in that they are for general use, without
a description of the service auditor’s tests and results.
10