# SOC 2 engagement letter: scope, period and management’s assertion [Home](/) / [Engagement letter templates](/templates/engagement-letters) / SOC 2 examination By [Arthur Teboul](/authors/arthur-teboul), Founder, DokuTrak. Published 2026-11-03, updated 2026-11-03. > **In brief:** A SOC 2 engagement letter is the agreement for a CPA firm’s exam of a service organization’s controls: the system, the trust services categories, the report type and period, and management’s written assertion ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). It also sets evidence dates and report users. ## The template: SOC 2 examination engagement letter **Not advice.** This page is general information, not tax, legal or HR advice. Rules change: check the cited source and ask your own professional before you rely on it. Last reviewed October 25, 2026. Fill in each [placeholder] and the scope table before you send it. Keep the readiness clause only if your firm also advised on the controls, and have counsel review the template once. ```text [CPA firm name] [Firm address] [Date] [Service organization legal name] Attention: [CISO or CEO name, title] [Address] Re: SOC 2 [type 1 / type 2] examination of [system name] Dear [Name], The engagement You have engaged [CPA firm name] to examine management’s description of [Service organization legal name]’s [system name] system and the suitability of the design [and operating effectiveness] of its controls, based on the description criteria and the trust services criteria for [security / availability / confidentiality / processing integrity / privacy]. We will perform the examination under the attestation standards established by the AICPA. Scope The scope is set out in the attached table: the system and its boundaries, infrastructure and locations, the trust services categories, the report type, the [as-of date (type 1) / examination period from (start date) to (end date) (type 2)], and each subservice organization with the carve-out or inclusive method. Changes to scope require a written amendment and may change our fee. Our responsibilities and the limits of an examination We will plan and perform the examination to obtain reasonable assurance and express an opinion. Because of their nature, controls may not prevent or detect every error or breach, and projections of our conclusions to future periods are subject to the risk that controls change or fail. Management’s responsibilities Management is responsible for: preparing the system description; selecting the criteria; identifying the risks that threaten the service commitments and system requirements; designing, implementing and operating controls to address them; and giving us access to all relevant information and to the people we need. Written assertion Management will give us a written assertion about the fairness of the description and the suitability of design [and operating effectiveness] of the controls, in draft by [date] and in final form with our report. If management will not provide it, we will withdraw from the engagement where the law allows. Subservice organizations and user entity controls For each carved-out vendor, management will give us its most recent SOC report by [date]. The description will list the complementary user entity controls and complementary subservice organization controls that the system relies on. Evidence calendar Management will deliver policies and procedures by [date]; populations of new hires, terminations, system changes and incidents for the period by [date]; and evidence for each sample we select within [number] business days of the request. Late evidence may move the report date and add fees. Independence and readiness work (optional) We will not design, implement, operate or monitor any control in scope. [Our earlier readiness assessment was limited to observations and recommendations; management made all decisions about controls and designated (name) to oversee that work.] Exceptions and the opinion Deviations we find will be described in the tests of controls. Depending on their nature, our opinion may be qualified or adverse, and we may withdraw if we cannot obtain enough evidence. Representation letter At the end of fieldwork, management will sign a representation letter dated as of our report date. Use of the report The report is intended for management, user entities of the system during the period, and their auditors, and for prospective customers who receive it under a confidentiality agreement. You will not post it publicly. Any bridge letter covering the time after the period is management’s own statement; we will not issue or sign it. Fees and schedule Our fee is [amount] for a [type 1 / type 2] report covering [categories]. Added categories, scope changes or retesting after remediation are billed at [rates]. Fieldwork is planned for [dates], with the report expected by [date]. Signatures Please sign and return this letter, with the scope table initialled, to confirm these terms. Sincerely, [CPA firm name] [Partner name], CPA, Partner Signature: ____________________ Date: __________ Agreed for [Service organization legal name]: [Officer name], [Title] Signature: ______________ Date: ________ ``` Download: [Word](https://dokutrak.com/downloads/pseo-v2/f2-engagement-letters/soc-2.docx) · [PDF](https://dokutrak.com/downloads/pseo-v2/f2-engagement-letters/soc-2.pdf) ## Which standard governs a SOC 2 letter A SOC 2 report comes out of an examination engagement under the AICPA attestation standards, AT-C 105 and AT-C 205 ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). AT-C 205 lists the terms the engagement letter must contain ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). The criteria come from the AICPA trust services criteria, which cover security, availability, processing integrity, confidentiality and privacy ([AICPA, 2017 Trust Services Criteria (revised points of focus, 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)). The **service organization** is the company whose system is examined, such as a payroll processor or a software vendor. It is usually both the engaging party and the responsible party. Its customers, the user entities, are the people who read the report. Why do customers ask for it? Some are bound by rules on vendor oversight. For example, the FTC Safeguards Rule requires covered financial institutions to select capable service providers, require safeguards by contract, and assess those providers periodically ([16 CFR 314.4, FTC Safeguards Rule, elements of the program](https://www.ecfr.gov/current/title-16/section-314.4)). An examination report on its controls is one way a vendor answers that request. ## The scope table: system, categories, type and period Disputes about these engagements usually start with scope. Put it in a table inside the letter, and attach the same table to the system description. The type and the dates matter most. A **type 1 report** covers the description and the design of controls as of a single date ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). A **type 2 report** adds whether the controls operated effectively throughout a period ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). The AICPA defines the two for service-organization reports in AT-C 320, and the same labels are used for these reports ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). Choose the period with the customer in mind. If the controls are new, ask whether a design-only report as of a date meets the customer’s request. Later reports cover a period, and customers ask that each one start where the last ended, so no months go uncovered. | Scope item | What to write | Example | | --- | --- | --- | | System | The named service and its boundaries | Hosted payroll application and its support process | | Infrastructure and locations | Data centers, cloud regions, offices in scope | Cloud region, head office | | Categories | Which trust services categories apply ([AICPA, 2017 Trust Services Criteria (revised points of focus, 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)) | Security and availability | | Report type | Design only as of a date, or design and operation over a period ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)) | Design and operation over a period | | Date or period | The as-of date, or the start and end of the period | [start date] to [end date] | | Subservice vendors | Each vendor and the carve-out or inclusive method | Cloud host, carve-out | ## What management signs up for Under AT-C 205 the practitioner requests a written assertion from the responsible party ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). When the engaging party is the responsible party and refuses, the practitioner withdraws where the law allows ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). Put the assertion in the letter as a duty, with the date you need the draft. Vendors matter too. With the **carve-out method**, the description names the services a subservice organization performs but leaves its controls out of scope ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). With the inclusive method, those controls are in scope and the vendor must cooperate. **Complementary user entity controls** are controls the service organization assumes its customers will run, such as reviewing user access lists ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). The description must list them, so customers know what they own. - Prepare the system description against the description criteria. - Provide the written assertion and, at the end, a representation letter. - Design, run and document the controls; identify the risks they address. - Provide populations, such as new hires, terminations, changes and incidents, on the evidence calendar. - Provide the SOC reports of carved-out vendors. ## Readiness work, independence and bridge letters The practitioner must be independent to perform an attestation engagement ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). Under the AICPA code, accepting responsibility for designing, implementing or maintaining a client’s internal control is a management responsibility, and it impairs independence ([AICPA Code of Professional Conduct, ET 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)). A firm that writes and runs the client’s controls cannot then examine them. Readiness work is possible within the nonattest rules: management makes the decisions, names an overseer and accepts the results ([AICPA Code of Professional Conduct, ET 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)). Write the boundary into the letter. A **bridge letter** is a letter management gives customers to cover the gap between the end of the last report period and today. It is management’s statement, so the letter should say the firm does not issue or sign it. ## Questions people ask ### What is the difference between a SOC 2 type 1 and type 2 engagement? A type 1 report covers the system description and control design as of one date; a type 2 report also covers whether the controls operated effectively throughout a period ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). The letter states which type and the date or period. ### Does management have to give a written assertion for a SOC 2? Yes. The practitioner requests one, and if the service organization is the engaging party and refuses, the practitioner withdraws where the law allows ([AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective)). ### Can the same CPA firm do SOC 2 readiness and the examination? Only within the independence rules. The firm may advise, but if it takes responsibility for designing or maintaining the controls, its independence is impaired ([AICPA Code of Professional Conduct, ET 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)). ### Who writes a SOC 2 bridge letter? Management of the service organization writes and signs it, to cover the period after the last report. The CPA firm does not issue it, and the engagement letter can say so. ## Sources - [AICPA SSAEs, AT-C 105, AT-C 205 and AT-C 320](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective): AT-C 205 lists the terms of an examination engagement letter and requires a written assertion; AT-C 105 requires independence; AT-C 320 defines type 1 and type 2 reports, the carve-out method and complementary user entity controls. - [AICPA, 2017 Trust Services Criteria (revised points of focus, 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022): The trust services criteria evaluate controls over security, availability, processing integrity, confidentiality or privacy. - [AICPA Code of Professional Conduct, ET 1.295](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf): Accepting responsibility for designing, implementing or maintaining internal control is a management responsibility that impairs independence for an attest client. - [16 CFR 314.4, FTC Safeguards Rule, elements of the program](https://www.ecfr.gov/current/title-16/section-314.4): Covered financial institutions must select capable service providers, require safeguards by contract and periodically assess them. ## More on this topic - [Audit engagement letter template](/templates/engagement-letters/audit) - [Agreed-upon procedures engagement letter](/templates/engagement-letters/agreed-upon-procedures) - [Engagement letter templates by service](/templates/engagement-letters) ## About the author Arthur Teboul (Founder, DokuTrak) is building DokuTrak after watching professionals lose hours chasing clients for documents over email. [Arthur Teboul](/authors/arthur-teboul). How this page was made (methodology): it is built from the primary sources listed under Sources, and every rule and figure on it links to the source it comes from. Last updated October 25, 2026. Spotted an error or a rule that changed? [Contact us](/contact). ## Ask once. DokuTrak does the chasing. - Your client uploads from one link, with no account and no password. - Reminders go out on a schedule, by default 2, 5, 10 and 14 days after the request, until the file arrives. - You accept every file or mark it for re-upload, and your client gets the note by email. The AI never accepts a file. 14-day free trial, no card. Add one only to keep going. [Request these documents with DokuTrak](https://app.dokutrak.com/sign-up?docs=contract%2Cinvoice)