SOC Engagement Process Simulation
Click on each step of the SOC engagement to see the details.
Step 1: Responding to Assessed Risks
The service auditor must obtain sufficient audit evidence to reduce attestation risk to an acceptably low level. This is to obtain reasonable assurance and draw conclusions on which to base the auditor's opinion.
Key Activities:- Design and implement overall responses to address the assessed risks of material misstatement.
- Determine the nature, extent, and timing of further procedures that are responsive to the assessed risks.
- Maintain professional skepticism, assign experienced staff, and provide additional supervision.
- Incorporate elements of unpredictability in the selection of procedures.
- Materiality considerations
- The auditor's understanding of the effectiveness of the control environment
- Other components of internal control related to the services provided to user entities
Step 2: Evaluating Management's Description
The service auditor must obtain and read management's description of the service organization's system and evaluate whether it is fairly presented in accordance with the description criteria.
- Are the control objectives stated in the description reasonable in the circumstances?
- Were the controls identified in the description implemented?
- Are complementary user entity controls and subservice organization controls adequately described?
- Are services performed by a subservice organization adequately described (including whether the carve-out or inclusive method is used)?
- Does the description present the system that was designed and implemented in accordance with the description criteria?
- Does the description include all relevant information related to the Trust Services Criteria?
- Does it not omit or distort information likely to be relevant to report users' decisions?
- Has each stated control actually been placed in operation (implemented)?
- Reviewing contracts with user entities
- Observing procedures performed by service organization personnel
- Reviewing policy and procedure manuals, flowcharts, and other system documentation
- Performing walk-throughs of transactions through the system
Step 3: Performing Tests of Controls (SOC 2® Type 2)
In this step, evidence is obtained about whether the controls stated in the description operated effectively throughout a specified period. This is divided into evaluating the suitability of design and testing operating effectiveness.
1. Procedures to Evaluate Suitability of Design:- Inquiring with service organization personnel about the design and operation of controls.
- Inspecting relevant documents and supporting system documentation.
- Performing additional walk-throughs.
- Determining whether attacks, vulnerabilities, emerging risks, or threats have been adequately addressed.
- Obtain evidence about how the control was applied, the consistency with which it was applied, and by whom.
- Determine whether the controls to be tested depend on other controls.
- Determine an effective method for selecting items to test.
- Nature: How controls are tested (e.g., inquiry, observation, reperformance).
- Extent: The size of the sample or number of observations (considering tolerable deviation rate, expected deviation rate, frequency of control, etc.).
- Timing: When the controls are tested (e.g., at an interim date, at period end).
Step 4: Evaluating the Results of Procedures
The auditor must evaluate the results of all procedures performed and consider whether sufficient evidence has been obtained to support the opinion and report. This includes both quantitative and qualitative analyses.
Considerations for Evaluation:- Whether identified misstatements in the description result in a failure to meet one or more of the description criteria.
- Whether identified deviations in control operation are within the expected rate and acceptable, or if they constitute a deficiency.
- Whether identified deficiencies are likely to have a pervasive effect on the achievement of the service organization's service commitments and system requirements.
- Whether report users could be misled if the opinion were not modified to reflect the identified deficiencies.
- Consideration of any known or suspected fraud or noncompliance with laws or regulations.
The service auditor should modify the opinion. An understanding of the nature and cause of the misstatements and deficiencies enables the auditor to determine how to appropriately modify the opinion.
Step 5: Reviewing Subsequent Events
Review transactions or events that occur after the engagement period but before the date of the service auditor's report that could have a significant effect on the description, the suitability of design of controls, and their operating effectiveness.
Examples of Subsequent Events Likely to Affect a SOC Report:- The IT director provided all programmers with access to production data files, enabling them to modify data.
- A confidentiality breach occurred during the period covered by the report (SOC 2®).
- Signatures on a number of trade execution instructions were discovered to have been forged (SOC 1®).
- A defalcation occurred at the service organization (SOC 1®).
- The service organization was acquired by another company.
- A major operational disruption was caused by weather or a natural disaster.
- Significant changes were made to its information systems, such as a system conversion or outsourcing.
Upon becoming aware of a significant subsequent event, the service auditor should request that management disclose the event in its assertion or the system description. If management refuses, the auditor should consider modifying the report or withdrawing from the engagement.
Step 6: Obtaining Written Representations From Management
The service auditor is required to obtain written representations from the management of the service organization. This confirms representations given to the auditor and reduces the possibility of misunderstanding.
Content of Written Representations Should Include:- Management's assertion about the subject matter based on the criteria.
- A statement that all relevant matters are reflected in the measurement or evaluation of the subject matter.
- A statement that all known matters contradicting the assertion and any communications from regulatory agencies have been disclosed.
- Acknowledgment of responsibility for the subject matter, assertion, and selecting the criteria.
- A statement that any known subsequent events have been disclosed.
- A statement that management has provided the service auditor with all relevant access and information.
- Disclosure of all known deficiencies in internal control, knowledge of any actual or suspected fraud, or noncompliance with laws.
If management does not provide one or more of the requested representations, or if the auditor concludes they are not reliable, it may constitute a scope limitation. In such cases, the auditor may be precluded from issuing an unmodified opinion and may withdraw from the engagement.
