SOC 2 engagement letter: scope, period and management’s assertion

A SOC 2 report comes out of an examination engagement under the AICPA attestation standards, AT-C 105 and AT-C 205 (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). AT-C 205 lists the terms the engagement letter must contain (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). The criteria come from the AICPA trust services criteria, which cover security, availability, processing integrity, confidentiality and privacy (AICPA, 2017 Trust Services Criteria (revised points of focus, 2022)).

The service organization is the company whose system is examined, such as a payroll processor or a software vendor. It is usually both the engaging party and the responsible party. Its customers, the user entities, are the people who read the report.

Why do customers ask for it? Some are bound by rules on vendor oversight. For example, the FTC Safeguards Rule requires covered financial institutions to select capable service providers, require safeguards by contract, and assess those providers periodically (16 CFR 314.4, FTC Safeguards Rule, elements of the program). An examination report on its controls is one way a vendor answers that request.

Disputes about these engagements usually start with scope. Put it in a table inside the letter, and attach the same table to the system description. The type and the dates matter most. A type 1 report covers the description and the design of controls as of a single date (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). A type 2 report adds whether the controls operated effectively throughout a period (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). The AICPA defines the two for service-organization reports in AT-C 320, and the same labels are used for these reports (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320).

Choose the period with the customer in mind. If the controls are new, ask whether a design-only report as of a date meets the customer’s request. Later reports cover a period, and customers ask that each one start where the last ended, so no months go uncovered.

Under AT-C 205 the practitioner requests a written assertion from the responsible party (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). When the engaging party is the responsible party and refuses, the practitioner withdraws where the law allows (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). Put the assertion in the letter as a duty, with the date you need the draft.

Vendors matter too. With the carve-out method, the description names the services a subservice organization performs but leaves its controls out of scope (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). With the inclusive method, those controls are in scope and the vendor must cooperate. Complementary user entity controls are controls the service organization assumes its customers will run, such as reviewing user access lists (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). The description must list them, so customers know what they own.

• Prepare the system description against the description criteria.
• Provide the written assertion and, at the end, a representation letter.
• Design, run and document the controls; identify the risks they address.
• Provide populations, such as new hires, terminations, changes and incidents, on the evidence calendar.
• Provide the SOC reports of carved-out vendors.

The practitioner must be independent to perform an attestation engagement (AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320). Under the AICPA code, accepting responsibility for designing, implementing or maintaining a client’s internal control is a management responsibility, and it impairs independence (AICPA Code of Professional Conduct, ET 1.295). A firm that writes and runs the client’s controls cannot then examine them.

Readiness work is possible within the nonattest rules: management makes the decisions, names an overseer and accepts the results (AICPA Code of Professional Conduct, ET 1.295). Write the boundary into the letter. A bridge letter is a letter management gives customers to cover the gap between the end of the last report period and today. It is management’s statement, so the letter should say the firm does not issue or sign it.

• AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320: AT-C 205 lists the terms of an examination engagement letter and requires a written assertion; AT-C 105 requires independence; AT-C 320 defines type 1 and type 2 reports, the carve-out method and complementary user entity controls.
• AICPA, 2017 Trust Services Criteria (revised points of focus, 2022): The trust services criteria evaluate controls over security, availability, processing integrity, confidentiality or privacy.
• AICPA Code of Professional Conduct, ET 1.295: Accepting responsibility for designing, implementing or maintaining internal control is a management responsibility that impairs independence for an attest client.
• 16 CFR 314.4, FTC Safeguards Rule, elements of the program: Covered financial institutions must select capable service providers, require safeguards by contract and periodically assess them.