Home / CPA Course / ISC
Reporting on a SOC engagement
ISC Chapter 19 · Area III · Blueprint III.B
Fieldwork on PayLoom's 2027 SOC 2 Type 2 is done. Now Priya and Sam have to turn months of testing into a report that strangers will rely on: Brightwater's controller, a prospective client's security team, user auditors at other firms. This last chapter follows the report section by section: what goes in it, how CUECs and carved-out subservice controls change the opinion wording, how each test and each exception is written up in Section 4, how to decide whether a deviation is a deficiency, which opinion fits which problem, how a modified report reads, and how SOC 1, SOC 2 and SOC 3 reports differ in form and audience. Finish here and the ISC journey closes where real IT audit work ends: with a signed report.
In this chapter
- The shape of a SOC 2 report
- Inside the service auditor's report
- How CUECs and CSOCs shape the report
- Writing up tests and results in Section 4
- From deviation to deficiency
- Opinion types and when to use them
- Writing a modified report
- SOC 1, SOC 2 and SOC 3 reports compared
This chapter has 8 lessons, 52 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.
What this chapter covers
- Effect of CUECs and CSOCs
- opinion types and modifications
- describing test results and exceptions
- report form and content