Definition
Description criteria are used to judge whether management's description of its system or program is fairly presented. They are separate from control criteria, which judge whether controls were effective. The AICPA publishes them in the DC sections: DC 200 for SOC 2 system descriptions, DC 100 for a cybersecurity risk management program and DC 300 for a supply chain production system. The SOC 1 description requirements sit in AT-C 320.
Why it matters in an audit or review
A SOC report gives two opinions at the least: one on the description and one on the controls. If the description omits a significant system component or a subservice organization's role, the user auditor cannot tell what the controls cover. Reading the description against the criteria is the first step in evaluating a report.
Example
Illustrative: a SOC 2 description says nothing about a data center hosted by a third party, although the vendor's backups depend on it. The user auditor asks the vendor how the third party is treated and checks whether the carve-out method is disclosed.
Common mistakes
- Treating the description as marketing text. It is a subject of the examination, and the practitioner reports on its fair presentation.
- Using DC 200 for a report under a different SOC engagement.
Sources
- AICPA, DC Section 200, 2018 Description Criteria for a Description of a Service Organization's System in a SOC 2 Report
- AICPA, DC Section 100 and DC Section 300 description criteria
- AICPA, AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error