Home / CPA Course / ISC

SOC engagements: types, users and criteria

ISC Chapter 17 · Area III · Blueprint III.A

Area III brings everything together in the engagement CPAs are known for in IT assurance: the System and Organization Controls (SOC) examination. PayLoom runs payroll for hundreds of companies, and every one of them, and their auditors, asks the same question: can we rely on your controls? This chapter sets the scene. Priya explains the SOC family and who each report is for, how the Trust Services Criteria are built from COSO, the subject matters a practitioner can report on, the assertions management makes in each type of report, and the service commitments and system requirements at the heart of every SOC 2. Chapters 18 and 19 then plan, perform and report the engagement.

In this chapter

1. Why SOC reports exist
2. Purpose, intended users and Type 1 versus Type 2
3. The Trust Services Criteria and how they are organized
4. What a practitioner can report on using the Trust Services Criteria
5. Management's assertions in SOC reports
6. Service commitments and system requirements

This chapter has 6 lessons, 50 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

• SOC 1, SOC 2, SOC 3 and SOC for Cybersecurity
• Type 1 and Type 2
• the Trust Services Criteria
• management assertions

Chapter 16: Incident response · Chapter 18: Planning and performing a SOC engagement