Accepting and Planning a SOC 2 ® Examination
AICPA · 2018
This chapter describes the service auditor's responsibilities, including the preconditions of engagement acceptance and the need to obtain a written assertion from and establish an understanding about the terms of the engagement with management. When providing assistance to management, the service auditor needs to exercise care that he or she does not make decisions on management's behalf, which would impair the service auditor's independence. When controls at the vendors are necessary in combination with the service organization's controls to provide reasonable assurance that the service organization's service commitments and system requirements are achieved based on the applicable trust services criteria, the vendor is considered a sub-service organization. The service organization designates a service organization employee to oversee the outsourced services, and that employee compares the vendor's test plans, test scripts, and test data to the service organization's application change requests and detailed design documents. The designated service organization employee also reviews the results of testing performed by the vendor before changes to the application are approved by the vendor and submitted to the service organization for user acceptance testing.