Definition
A SOC 3 report comes from the same kind of examination as a SOC 2, performed under AT-C 205 using the trust services criteria. The report contains the practitioner's opinion, management's assertion and a brief description of system boundaries and commitments. It leaves out the detailed system description, the tests performed and the results, and it is designed for general use rather than restricted to specified parties.
Why it matters in an audit or review
An auditor cannot use a SOC 3 the way a SOC 1 or SOC 2 is used. With no test results, it shows the opinion but not the exceptions or complementary user entity controls. For a user auditor assessing a service organization, the SOC 2 or SOC 1 is the working document.
Example
Illustrative: a software vendor posts a SOC 3 on its website for prospects. A customer's auditor asks for the vendor's SOC 2 Type 2 instead, because it lists the controls tested and any deviations. The SOC 3 confirms the opinion was unmodified but does not show how the controls operated.
Common mistakes
- Citing a SOC 3 as evidence of tested controls.
- Assuming a SOC 3 is a lighter engagement. The examination work is the same.
Sources
- AICPA, AT-C Section 205, Assertion-Based Examination Engagements
- AICPA, TSP Section 100, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
- AICPA, SOC for Service Organizations: Trust Services Criteria overview, https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error