Guide: SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy

Content: Intro
 Title Page
 Copyright
 Chapter 1 Introduction and Background
 Introduction
 Intended Users of a SOC 2® Report
 Overview of a SOC 2® Examination
 Contents of the SOC 2® Report
 Definition of a System
 Boundaries of the System
 Time Frame of Examination
 Difference Between Privacy and Confidentiality
 Criteria for a SOC 2® Examination
 The Service Organization's Service Commitments and System Requirements
 SOC 2® Examination That Addresses Additional Subject Matters and Additional Criteria
 SOC 3® Examination
 Other Types of SOC Examinations: SOC Suite of Services SOC 1®-SOC for Service Organizations: ICFRSOC for Cybersecurity
 Professional Standards
 Attestation Standards
 Code of Professional Conduct
 Quality in the SOC 2® Examination
 Definitions
 Chapter 2 Accepting and Planning a SOC 2® Examination
 Introduction
 Understanding Service Organization Management's Responsibilities
 Management Responsibilities Prior to Engaging the Service Auditor
 Management Responsibilities During the Examination
 Management's Responsibilities During Engagement Completion
 Responsibilities of the Service Auditor
 Engagement Acceptance and Continuance
 Independence Competence of Engagement Team MembersPreconditions of a SOC 2® Engagement
 Determining Whether the Subject Matter Is Appropriate for the SOC 2® Examination
 Determining Whether Management Is Likely to Have a Reasonable Basis for Its Assertion
 Assessing the Suitability and Availability of Criteria
 Assessing the Appropriateness of the Service Organization's Principal Service Commitments and System Requirements Stated in the Description
 Requesting a Written Assertion and Representations From Service Organization Management
 Agreeing on the Terms of the Engagement Accepting a Change in the Terms of the ExaminationAdditional Considerations for a Request to Extend or Modify the Period Covered by the Examination
 Establishing an Overall Examination Strategy for and Planning the Examination
 Planning Considerations When the Inclusive Method Is Used to Present the Services of a Subservice Organization
 Considering Materiality During Planning
 Performing Risk Assessment Procedures
 Obtaining an Understanding of the Service Organization's System
 Assessing the Risk of Material Misstatement
 Considering Entity-Level Controls Understanding the Internal Audit FunctionPlanning to Use the Work of Internal Auditors
 Evaluating the Competence, Objectivity, and Systematic Approach Used by Internal Auditors
 Determining the Extent to Which to Use the Work of Internal Auditors
 Coordinating Procedures With the Internal Auditors
 Evaluating Whether the Work of Internal Auditors Is Adequate for the Service Auditor's Purposes
 Planning to Use the Work of an Other Practitioner
 Planning to Use the Work of a Service Auditor's Specialist
 Accepting and Planning a SOC 3® Examination
 Chapter 3 Performing the SOC 2® Examination