M3 - Reporting on SOC Engagements

Study Notes

Complementary Subservice Organization Controls (CSOC) are controls implemented at a sub-service or vendor organization, necessary for achieving service organization control objectives.
Service auditors must ensure the services and controls are adequately described.
The Carve-Out method excludes CSOCs and is used if a Type 1 or 2 auditor's report exists for the sub-service. It includes: the nature of services performed, types of controls expected at the sub-service, how the service org monitors the sub-service, and trust services intended by CSOC.
The Inclusive method addresses services from a sub-service organization, is used for more complex services. The auditor must be independent from the sub-service. It includes: the nature of the services provided, and components of the sub-service organization's system.

CUECs are controls implemented by the user entity working with service organization controls.
Management must ensure system descriptions include CUECs.
Examples include security monitoring, managed service provider (MSP) environment changes, encrypted financial data, physical access controls, and authorization policies.
CUECs are identified in the SOC engagement's OPINION and SCOPE sections. A service auditor's report that does not evaluate CUECs' design suitability or operating effectiveness is qualified.

When giving a modified opinion, a service auditor adds a separate paragraph explaining the modifying matter.
A qualified opinion is issued when an explanation of matters is added to the SOC report. The OPINION section is amended to include the explanation.
For Type 1 reports, an "Other Matter Paragraph" states that operating effectiveness procedures were not performed and no opinion is expressed on operating effectiveness.

Qualified SOC 1 opinions use the phrase "except for" in the Qualified Opinion Section.
Qualified SOC 2 opinions include "basis for qualified opinion" in the Service Auditors Responsibilities and "except for" in the Qualified Opinion Section.

Adverse SOC 1 opinions state "because," "does not fairly present," "not suitably designed," or "do not operate effectively" in the Adverse Opinion Section.
Adverse SOC 2 opinions include "basis for adverse opinion" and similar phrases as SOC 1 in the Service Auditors Responsibilities and Adverse Opinion sections.