SOC 1 and SOC 2 Reports: Understanding Trust Services

Service Organization Control (SOC) reports are essential tools for IT auditors assessing risks associated with outsourced services. Understanding the differences between SOC 1 and SOC 2 reports, the trust services criteria, and how to effectively use these reports is a critical skill for CISA professionals.

SOC 1 Reports

SOC 1 reports, governed by SSAE 18 (AT-C Section 320), focus on controls at a service organization relevant to user entities' internal control over financial reporting (ICFR). These reports are primarily used by financial auditors to evaluate the impact of outsourced processing on financial statement audits.

Type I vs. Type II

Type I: Describes the service organization's system and the suitability of control design at a specific point in time. Useful for understanding what controls exist but does not test whether they operated effectively.
Type II: Includes everything in Type I plus testing of operating effectiveness over a specified period (typically six to twelve months). This is the more valuable report for reliance purposes.

SOC 2 Reports

SOC 2 reports evaluate controls relevant to security, availability, processing integrity, confidentiality, and privacy. These reports use the AICPA Trust Services Criteria and are more broadly applicable than SOC 1 for IT audit purposes.

Trust Services Criteria

Security (Common Criteria): The system is protected against unauthorized access, both physical and logical. This is always included in a SOC 2 report.
Availability: The system is available for operation and use as committed or agreed. Relevant for service level agreements and uptime requirements.
Processing Integrity: System processing is complete, valid, accurate, timely, and authorized. Critical for transaction processing services.
Confidentiality: Information designated as confidential is protected as committed or agreed. Important for services handling sensitive business data.
Privacy: Personal information is collected, used, retained, disclosed, and disposed of in conformity with commitments. Relevant for services processing personal data.

Reading and Using SOC Reports

Key Sections to Review

When evaluating a SOC report, focus on these critical sections:

Auditor's Opinion: Look for qualified or adverse opinions that indicate control deficiencies
System Description: Understand the scope of services covered and any exclusions
Complementary User Entity Controls (CUECs): Identify controls that your organization must implement for the overall control environment to be effective
Complementary Subservice Organization Controls (CSOCs): Understand dependencies on fourth parties not covered by the report
Testing Results (Type II): Review any exceptions noted in control testing and evaluate their significance

Evaluating Report Quality

Assess whether the report period aligns with your audit period. A gap between the SOC report period and your audit period may require additional procedures. Verify that the scope of services described in the report matches the services your organization actually uses. Review the CUECs to ensure your organization has implemented the required complementary controls.

SOC 2+ Reports

SOC 2+ reports add criteria from additional frameworks (such as HITRUST CSF, Cloud Security Alliance CCM, or ISO 27001) to the standard trust services criteria. These combined reports can satisfy multiple compliance requirements simultaneously and reduce audit fatigue for service organizations.

Practical Considerations for IT Auditors

Request SOC reports from all critical service providers annually
Track and follow up on noted exceptions and management responses
Verify that CUECs are implemented and operating effectively within your organization
Assess the impact of any carve-out subservice organizations not covered by the report
Consider the qualifications and reputation of the service auditor who issued the report

SOC reports are indispensable for IT auditors managing third-party risk. CISA professionals should develop proficiency in reading, evaluating, and acting on the information these reports contain.