Definition
Each criterion in TSP section 100 is followed by points of focus. They describe important characteristics of the criterion and offer guidance on designing, implementing and operating controls. The AICPA revised them in 2022. They are not criteria themselves, and neither management nor the service auditor must show that every point of focus is addressed.
Why it matters in an audit or review
A report that lists unmet points of focus as exceptions misreads the framework. The service auditor evaluates whether the criterion is met. Points of focus help the service auditor judge whether the controls cover what the criterion is aiming at, and management can use them when mapping its controls to the criteria.
Example
Illustrative: criterion CC6.1 addresses logical access security. A listed point of focus covers restricting access to protected information assets. The vendor uses role-based access with no separate password policy for one legacy tool, and compensates through network-level restrictions. The criterion can still be met even though that specific point is handled differently.
Common mistakes
- Treating points of focus as a mandatory checklist and failing an engagement on one missing item.
- Copying points of focus into a system description as if they were the entity's controls.
FAQ
Must a SOC 2 report address every point of focus?
No. The criteria are what the practitioner evaluates. Points of focus are guidance and do not each have to be addressed.
Sources
- AICPA, TSP Section 100, 2017 Trust Services Criteria (With Revised Points of Focus, 2022), introductory material on criteria and points of focus
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error