SOC 2.
Align examination scope, report type and evidence so that customers can assess the service they actually use.
- AICPA TSC 2017 · Points of Focus 2022
- By Derya Altinay
- As of: 10/22/2026
- Reading time: 7 min.
Short answer.
SOC 2 is an examination report on controls of a defined service system based on the AICPA Trust Services Criteria. An independent CPA firm assesses the system description and control design. Type 2 additionally covers their operating effectiveness over a defined period; Type 1 concerns a point in time.
SOC 2 and the Trust Services Criteria.
SOC 2 belongs to the AICPA System and Organization Controls suite. Service providers use it to have their system controls examined by an independent service auditor. The AICPA describes these reports as an information basis for outsourced service risks. Which service and commitments were examined, and what statements the specific engagement covers, are therefore decisive.
The Trust Services Criteria organise security, availability, processing integrity, confidentiality and privacy. The publicly offered basis is called the 2017 Trust Services Criteria with revised Points of Focus 2022. Common criteria and additional categories are considered together in the engagement; the category names do not mean five identical mandatory packages for every service. A category's content is not a prescribed software product either.
The system description has its own benchmark: the 2018 SOC 2 Description Criteria with revised implementation guidance 2022. It explains what belongs to the system and how it operates. Control assessment then examines the associated arrangements. A complete report connects these perspectives; a logo alone shows neither scope nor opinion.
Who a SOC 2 report is intended for.
A SOC 2 report serves service providers and customers seeking to assess their services. According to the AICPA's public description of the examination guide, customers need information on control design, operation and effectiveness when outsourcing functions. This concerns, for example, information handling or dependency on a provided system; it does not imply a particular company size.
Customer needs help determine meaningful examination scope. Before commissioning, clarify which product, operating environment and commitments are material to recipients. A contractual evidence requirement should be compared with the report actually planned. SOC 2 creates no blanket statutory examination duty for every SaaS provider.
SOC 2 preparation in six work areas.
Preparation connects an agreed examination engagement with traceable operational controls. The following areas are a practical structure; they do not create a new official criteria list. Applicable Trust Services Criteria and Description Criteria remain the basis.
Describe system boundaries and commitments.
Name the service offered and the people, processes, systems and dependencies relevant to it. The description should fit the actual service customers purchase. According to the AICPA management resource, the system description and management assertion are separate report components; a technical inventory alone does not explain these relationships.
Agree categories and risks.
Service commitments and intended users' information needs help select relevant categories. Record why an issue lies within scope and which risks should be examined. The AICPA review checklist calls for consideration of whether covered categories and commitments are sufficient for your own use.
Operate controls with clear ownership.
Describe specific operational arrangements and the people performing or overseeing them. Different services may need different controls. A general policy contributes to evidence only where its requirements reach relevant processes and actual execution is traceable.
Collect evidence at the right time.
Evidence must support the examined statement in time. The agreed date is decisive for Type 1; the defined examination period for Type 2. A newly created screenshot cannot readily demonstrate earlier operation. The AICPA explicitly refers to the auditor's professional judgement when assessing timing.
Clarify outsourced services and customer tasks.
Explain how material subservice organisations are treated in the report and which tasks remain with customers. The review checklist distinguishes complementary user entity controls from other user responsibilities. For preparation, a clear allocation is recommended rather than grouping every activity in a general supplier list.
Assess changes and exceptions.
Examination results need context from the affected service. Document corrections and significant changes so that their effect can be assessed. A single test exception and a qualified opinion are different statements. The AICPA management resource supports separate consideration of the opinion, tests, results and other information.
The path to a SOC 2 report.
Clarify recipients and needs.
As a practical starting point, record which customer wants to assess which service and what decision the report should inform.
Define the examination engagement.
Agree the system description, relevant categories, report type and planned date or period with a suitable independent CPA firm.
Connect controls and responsibility.
Check with the responsible business functions whether described processes actually operate and which records make their operation traceable.
Keep operational evidence available.
Organise collection of suitable evidence during the agreed period and clarify evidence for material external dependencies early.
Address findings.
Discuss open questions and exceptions against specific evidence, and record corrections and responsibility for residual risks.
Evaluate the report in its use context.
After issue, read scope, opinion, period and customer tasks together, and plan to evaluate subsequent significant changes.
Read SOC 2 Type 2 and Type 1 correctly.
Type 1 and Type 2 answer different temporal questions. Type 1 concerns the system description and control design at a point in time. SOC 2 Type 2 additionally covers operating effectiveness over the stated period. The AICPA review checklist records this distinction in the general report details.
A licensed CPA firm issues the SOC 2 report. Check the responsible firm, its relevant licence and the engagement actually described. Preparation by a consultant or tool provider is distinct from the independent examination service. The organisation remains responsible for its controls.
The report has no blanket validity term like a certificate. Its usefulness depends on whether the system, period and opinion fit current customer needs. A subsequent migration or other significant change may raise additional questions. Document review therefore remains part of your own provider decision.
Understanding other frameworks.
ISO 27001 concerns an information security management system and its possible certification. BSI C5 follows its own examination model for cloud services. The GDPR governs personal data processing; a SOC 2 report does not replace examination of these statutory duties.
In Secani.
Secani provides an editorial work catalogue for the AICPA Trust Services Criteria with original implementation guidance. Profile details distinguish the agreed examination engagement and additional categories. Controls and evidence can be managed in their working context; the original working aid replaces neither the protected criteria standard nor the independent examination.
Start with customer needs.
Choose a service actually offered and record the report's intended recipients. Describe what statement they need about the service and which operational boundary is relevant. With this basis, discuss report type, scope and necessary preparation with a suitable examination firm.
Sources.
- AICPA – SOC Suite of Services
- AICPA – 2017 Trust Services Criteria, Points of Focus 2022
- AICPA – 2018 Description Criteria, Guidance 2022
- AICPA – Key Elements of a SOC 2 Report and review checklist
- AICPA – Maintaining high standards for SOC engagements
- AICPA – public description of the SOC 2 examination guide
Frequently asked questions.
No. SOC 2 is an independent service auditor's examination report on a described system and its controls, rather than an ISO certificate or general product seal.
Type 1 concerns control design at a point in time. Type 2 additionally covers operating effectiveness over the agreed examination period.
No general fixed obligation or test frequency follows from it. Risks, described controls and the agreed engagement determine appropriate evidence; customer contracts may contain additional expectations.
The report describes its point in time or examination period. Whether it is sufficient for a current decision also depends on the service covered, intervening changes and recipient requirements.
Clarify the examination scope.
Discuss how you can organise controls and evidence for your service in Secani.
This page explains SOC 2 in our own words. Applicable AICPA standards and the specific engagement take precedence; the description does not replace professional examination.