Clients now get asked about cybersecurity by lenders, boards, insurers and customers, and a CPA is in a position to give an independent, attestation-based answer. The AICPA built a reporting framework for that purpose: the cybersecurity risk management examination, part of the SOC for Cybersecurity suite. This post covers the engagement from the practitioner's side: what the subject matter is, which criteria are used, how scope gets set and where a firm should be careful. If you want to read a finished report, see our guide to the SOC for Cybersecurity report.
What the engagement is
The AICPA released the cybersecurity reporting framework and supporting criteria on April 26, 2017. The Center for Audit Quality's alert on the release described three components of the reporting:
- management's description of its cybersecurity risk management program
- management's assertion about that description and about the effectiveness of the program's controls
- the CPA's opinion on both
The practitioner's opinion covers two things. First, whether the description of the entity's cybersecurity risk management program was presented in accordance with the description criteria. Second, whether the controls within that program were effective in achieving the entity's cybersecurity objectives, based on the control criteria. The examination is an attestation engagement performed under the AICPA's attestation standards, and the AICPA guide for it is Reporting on an Entity's Cybersecurity Risk Management Program and Controls.
Two sets of criteria
The engagement needs a standard against which to measure. The framework supplies two:
- Description criteria. DC section 100, Description Criteria for Management's Description of an Entity's Cybersecurity Risk Management Program, is used by management to prepare its description and by the CPA to evaluate it.
- Control criteria. The 2017 Trust Services Criteria (TSP section 100, with 2022 revised points of focus), covering security, availability, processing integrity, confidentiality and privacy. The security, availability and confidentiality criteria are the ones suitable for evaluating whether the controls were effective. Other suitable criteria, for either the description or the controls, may be used.
If the client already uses a recognized framework, the engagement can be run against suitable criteria other than the AICPA's, provided they meet the attestation standards' suitability requirements. Whatever you choose is stated in the report.
How it differs from a SOC 2
The cybersecurity examination and a SOC 2 examination share TSP section 100 as a source of control criteria, which is why they get confused. The differences are structural. The AICPA's own comparison table sets them out:
| Feature | SOC 2 | SOC for Cybersecurity |
|---|---|---|
| Organizations | A service organization | Any type of organization |
| Level | Generally a system or systems providing services | Generally entity-wide program, scope can be narrowed to a system, unit or function |
| Responsible party | Service organization management | Entity management |
| Controls objective | Service commitments and system requirements | The entity's cybersecurity objectives |
| Use of third parties | Management may use the inclusive or carve-out method | Management is responsible for all controls within the program, whether performed by the entity or a third party |
| Distribution | Restricted to specified parties with sufficient knowledge | Appropriate for general use |
The third-party row is the one that changes the work. In a carve-out SOC 2, controls at a subservice organization are outside the opinion. In a cybersecurity examination, the description criteria require the description to address all controls within the program, including those a third party performs. A client that outsources security monitoring cannot leave it out of the examination.
How it differs from a financial statement audit
A cybersecurity examination is not an audit of internal control over financial reporting, and it does not conclude on whether the financial statements are fairly presented. It speaks to a cybersecurity program against stated objectives. It can inform your understanding of IT risk at an audit client, but it does not replace your ITGC work, and an unqualified opinion on the program is not evidence that financial reporting controls operate. The IT audit guide covers what the audit needs from technology.
Setting scope with the client
Scope is the first and hardest decision. Settle these before accepting the engagement:
- Entity-wide or narrowed? The default is the entity-wide program. Narrowing to one system, business unit or function is permitted, so the description must state the boundary clearly.
- What are the cybersecurity objectives? Management states them. If the client cannot articulate its objectives, the engagement is not ready.
- What period or date? The report has to state the date or period it covers. Match it to what the report's users need.
- Which criteria? Agree the description and control criteria in the engagement letter.
- Who are the users? The report is suited to general use, and the practitioner may still decide to restrict use to specified parties.
The engagement letter guide covers the contents for attestation work; add the criteria, the scope boundary and the reporting period.
Readiness work
The CAQ alert noted that CPAs can use the criteria for consulting "readiness" engagements with companies not yet ready for an examination. This is a reasonable first step for most clients. The cautions are independence and objectivity. If you design the client's controls in a readiness engagement and then examine them, evaluate whether your firm can still be independent for the examination under the AICPA Code's nonattest services provisions, and whether management retains the responsibility it has to hold. Many firms separate the two by engagement team, and some by firm.
Staffing and quality
An examination needs people who understand the technology. Most small firms do not have that depth in-house. Options include hiring specialists, engaging an outside specialist under the Code's and attestation standards' requirements, or declining the engagement. Whichever you choose, consider the firm's quality management obligations, covered in our SQMS 1 guide, including competence and the use of external specialists.
Frequently asked questions
Who can request a cybersecurity risk management examination?
Any type of organization. It is not limited to service organizations.
Is the report restricted to specified parties?
The framework describes it as appropriate for general use, though the practitioner may decide to restrict use.
Does it replace a SOC 2 report?
No. They answer different questions. A SOC 2 reports on a service organization's system against its service commitments. The cybersecurity examination reports on an entity-wide program against the entity's cybersecurity objectives.
Can the CPA firm that audits the financial statements also perform the examination?
It can be done, subject to independence requirements and a decision on how the two teams interact. Treat it as its own engagement with its own acceptance process.
Sources
- Center for Audit Quality, CAQ Alert #2017-01, AICPA Publishes Criteria to Evaluate and Report on Cybersecurity (April 26, 2017): https://www.thecaq.org/caq-alert-2017-01-aicpa-publishes-criteria-evaluate-and-report-cybersecurity
- AICPA, Appendix A: Comparison of SOC 1, SOC 2, and SOC for Cybersecurity Examinations and Related Reports (as published by the U.S. Department of Labor ERISA Advisory Council): https://www.dol.gov/sites/dolgov/files/ebsa/pdf_files/2022-cybersecurity-issues-affecting-health-benefit-plans-blanco-best-written-statement-appendix-a-07-18.pdf
- AICPA, Reporting on an Entity's Cybersecurity Risk Management Program and Controls (attestation guide): https://www.aicpa-cima.com/cpe-learning/publication/reporting-on-an-entitys-cybersecurity-risk-management-program-and-controls-attestation-guide
- AICPA, Illustrative Cybersecurity Risk Management Report (SOC for Cybersecurity): https://www.aicpa-cima.com/resources/download/get-an-illustrative-cybersecurity-risk-management-report
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error