The SOC suite and the Trust Services Criteria

Why SOC reports exist

When a company outsources payroll, hosts its systems with a cloud provider or sends claims to a processor, some of its controls now operate inside another organization. The outsourcing company, and its auditor, still need to know whether those controls work. Inviting every customer to audit the provider would be costly for everyone. Instead, the provider engages a CPA to examine its controls once and issue a report that its customers can use.

The AICPA calls this family of engagements System and Organization Controls (SOC). It is a suite of services that CPAs provide on the system-level controls of a service organization, or on the entity-level controls of other organizations (AICPA, SOC Suite of Services). The vocabulary comes from AT-C section 320 (AICPA, Attestation Standards):

• Service organization: the organization (or segment of one) that provides services to user entities.
• User entity: a customer whose controls are affected by the service organization's controls.
• Service auditor: the practitioner who reports on the service organization's controls.
• User auditor: the auditor who audits a user entity's financial statements.
• Subservice organization: a service organization used by the service organization to perform part of the services.

The four reports the blueprint names

The ISC blueprint asks you to recall the purpose and intended users of SOC 1, SOC 2, SOC 3 and SOC for Cybersecurity reports (ISC blueprint, Area III, Group A).

Report	Subject matter	Criteria	Intended users	Use
SOC 1	Controls at a service organization likely to be relevant to user entities' internal control over financial reporting (ICFR)	Control objectives specified by management, plus the description criteria in AT-C section 320	Management of the service organization, user entities and their auditors	Restricted
SOC 2	Controls relevant to security, availability, processing integrity, confidentiality or privacy	Trust Services Criteria (control criteria) and the SOC 2 description criteria	Management, customers and others with enough knowledge of the system to understand the report	Restricted
SOC 3	The same five categories as SOC 2, with less detail	Trust Services Criteria	Anyone	General use
SOC for Cybersecurity	An entity's enterprise-wide cybersecurity risk management program	Description criteria for the program plus control criteria such as the Trust Services Criteria	A broad range of users interested in the entity's cyber risk management	General use

Sources: AICPA's SOC 1, SOC 3 and SOC for Cybersecurity pages; AT-C section 320 for SOC 1's users and restricted-use alert.

Points to hold onto:

• SOC 1 is about financial reporting. The AICPA's SOC 1 page says the reports serve user entities and the CPAs who audit their financial statements, so they can evaluate the effect of the service organization's controls on those statements (AICPA, SOC 1). A payroll processor or a loan servicer is a classic SOC 1 provider.
• SOC 2 is about the operation of a system. It addresses one or more of the five trust services categories. A data center, a software-as-a-service company or a cloud provider is a classic SOC 2 provider.
• SOC 3 is the short, public version. The AICPA describes SOC 3 reports as addressing the same categories as SOC 2 without the same level of detail, so they are general use and can be freely distributed (AICPA, SOC 3). An illustrative SOC 3 report contains management's assertion, a description of the system's boundaries and its principal service commitments and system requirements, and the service auditor's report. It has no detailed description of tests (AICPA, Illustrative SOC 3 Report).
• SOC for Cybersecurity looks at the whole entity, not a service. It reports on an organization's cybersecurity risk management program (AICPA, SOC for Cybersecurity), and any organization can undergo it, not only a service organization.

The AICPA also offers SOC for Supply Chain, for controls over a production, manufacturing or distribution system (AICPA, SOC Suite of Services). It is outside the blueprint's list, so recognize the name and move on.

Type 1 and type 2

SOC 1 and SOC 2 reports come in two types (AT-C section 320 defines them for SOC 1; SOC 2 uses the same idea):

Feature	Type 1	Type 2
Time covered	As of a specified date	Throughout a specified period
Opinion on fair presentation of the description	Yes	Yes
Opinion on suitability of design	Yes	Yes
Opinion on operating effectiveness	No	Yes
Description of tests of controls and results	No	Yes

A type 1 report tells a user that the system is described fairly and the controls are designed well on one day. Only a type 2 report gives evidence that the controls actually worked over time. A user auditor who wants to rely on a service organization's controls to reduce substantive testing needs evidence of operating effectiveness, which a type 2 report provides.

Management's assertions

In every SOC examination, management of the service organization gives a written assertion that accompanies its description, and the service auditor reports on it (AT-C section 320 requires the service auditor to request it). The assertions follow the type:

Report	Management asserts that…
SOC 1 type 1	The description fairly presents the system designed and implemented as of a date, and the controls were suitably designed to achieve the stated control objectives as of that date
SOC 1 type 2	The description fairly presents the system throughout the period, and the controls were suitably designed and operated effectively throughout the period to achieve the control objectives
SOC 2 type 1	The description is presented in accordance with the description criteria, and the controls were suitably designed as of a date to provide reasonable assurance that the service commitments and system requirements would be achieved based on the applicable Trust Services Criteria
SOC 2 type 2	The same, throughout a period, plus operating effectiveness
SOC 3	The controls were effective throughout the period to provide reasonable assurance that the service commitments and system requirements were achieved based on the applicable Trust Services Criteria

Trap: SOC 1 measures controls against control objectives that management specifies. SOC 2 measures them against the Trust Services Criteria that the AICPA establishes, in relation to the entity's service commitments and system requirements.

The Trust Services Criteria

The 2017 Trust Services Criteria (with revised points of focus, 2022) are control criteria established by the AICPA's Assurance Services Executive Committee. Practitioners use them in attestation or consulting engagements to evaluate and report on controls over the security, availability, processing integrity, confidentiality or privacy of information and systems (AICPA, 2017 Trust Services Criteria). They are the criteria named in the ISC blueprint's references, and they can be applied to different subject matters: an entire entity, a subsidiary, division or operating unit, a function relevant to the entity's objectives, or a particular type of information the entity uses.

The five categories

Category	The question it answers
Security	Is the system protected against unauthorized access, use or disclosure?
Availability	Is the system available for operation and use as committed?
Processing integrity	Is processing complete, valid, accurate, timely and authorized?
Confidentiality	Is information designated as confidential protected as committed?
Privacy	Is personal information collected, used, retained, disclosed and disposed of as committed?

How the criteria are organized

The blueprint asks you to explain the organization of the TSC, including their alignment with COSO, the common criteria, supplemental criteria and additional specific criteria (ISC blueprint, Area III, Group A).

1. Common criteria (CC series) apply in every SOC 2 engagement and fully address the security category.
   • CC1–CC5 align with the 17 principles of COSO's Internal Control — Integrated Framework (2013) (COSO, Guidance on Internal Control): CC1 control environment, CC2 communication and information, CC3 risk assessment, CC4 monitoring activities, CC5 control activities.
   • Supplemental criteria extend the COSO-based criteria for technology: CC6 logical and physical access controls, CC7 system operations, CC8 change management, CC9 risk mitigation.
2. Additional specific criteria apply only when the engagement covers that category: A1 (availability), PI1 (processing integrity), C1 (confidentiality) and P1–P8 (privacy).
3. Points of focus describe important characteristics of each criterion. They are illustrations to consider, not requirements that must all be met.

Worked example. A SaaS payroll company asks for a SOC 2 covering security and availability. The applicable criteria are the common criteria (CC1–CC9) plus the availability criteria (A1). Processing integrity, confidentiality and privacy criteria do not apply because those categories are out of scope, even though the company handles sensitive data. A customer that needs assurance about confidentiality would have to ask for that category to be added.

Service commitments and system requirements

In a SOC 2, the criteria are applied to the entity's own objectives, which DC 200 and the TSC frame as service commitments and system requirements (AICPA, 2018 SOC 2 Description Criteria; blueprint Area III, Group A):

• Service commitments are what the service organization promises its customers about the system's performance: in contracts, service level agreements, or public statements such as a published security commitment. Example: "Customer data is encrypted at rest and in transit"; "the platform will be available 99.9% of each month."
• System requirements are the specifications for how the system must function to meet those commitments and to comply with laws and the organization's own policies. Example: an internal standard that all production databases use encryption with managed keys, or that backups are replicated to a second region daily.

A SOC 2 asks whether the controls provide reasonable assurance that these commitments and requirements are achieved under the applicable criteria. That is why two cloud providers can have different SOC 2 reports even when both are well run.

What is changing

The AICPA has exposed proposed 2027 revisions to the Trust Services Criteria and the SOC 2 description criteria for public comment (AICPA, Exposure Drafts: Proposed 2027 SOC 2 Trust Services Criteria and Description Criteria). They are proposals. For the exam, study the editions the ISC blueprint names: the 2017 TSC with 2022 points of focus and the 2018 description criteria with 2022 implementation guidance.

Common traps

• "SOC 3 is a type 3." No. Types (1 and 2) describe the time frame and opinions. SOC 1, 2 and 3 are different reports.
• "A SOC 2 always covers all five categories." It covers security plus any other categories the service organization chooses.
• "A type 1 report shows controls worked." It covers design and implementation at a date, not operating effectiveness.
• "SOC 2 reports can be posted on a website for anyone." That is SOC 3. SOC 2 reports are restricted to users who can understand them.

Check yourself

• Which SOC report would a user auditor of a company that outsources payroll most likely request, and which type?
• Which SOC 2 criteria always apply, and which apply only when a category is in scope?
• How do CC1–CC5 relate to COSO's internal control framework?
• What does management assert in a SOC 2 type 2 that it does not assert in a type 1?
• Give one example of a service commitment and one of a system requirement for a cloud-hosting company.