Definition
A SOC 2 report is an examination report from a service auditor on a service organization's controls relevant to one or more of the AICPA trust services criteria: security, availability, processing integrity, confidentiality and privacy. Security is always included. Reports are issued under the attestation standards (AT-C 105 and 205) and, like SOC 1, can be Type 1 or Type 2.
Why it matters in an audit or review
For a financial statement audit, a SOC 2 report is generally not evidence about controls over financial reporting. It can still help the auditor understand IT security at a vendor hosting the client's systems, for example when assessing risks arising from IT. If the auditor needs evidence on transaction processing controls at a provider, a SOC 1 is the relevant report.
Example
A client's cloud ERP vendor gives the auditor a SOC 2 Type 2 covering security and availability. The auditor reads it to understand logical access and backup controls at the vendor, notes the complementary user entity controls the client must run (such as user provisioning), and then asks the vendor for a SOC 1 to cover processing controls the audit depends on.
Common mistakes
Using a SOC 2 report to support reliance on transaction-level controls it does not address.
Sources
- AICPA, AT-C Section 105, Concepts Common to All Attestation Engagements; AT-C Section 205, Assertion-Based Examination Engagements
- AICPA, TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus, 2022)
- AICPA, Guide: SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error