Independent assurance

SOC 2 Attestation Services

Helping technology and service organizations understand the scope, evidence and reporting involved in a SOC 2 examination.

What is SOC 2?

SOC 2 is an independent examination of a service organization’s description of its system and the controls relevant to the AICPA Trust Services Criteria. Those criteria cover security, availability, processing integrity, confidentiality and privacy. A report can help customers and other specified users understand how a service is designed and how relevant controls are addressed. SOC 2 is an attestation report, not a certification or a guarantee that a system is free from risk.

The scope and criteria are selected for the engagement based on the service, risks and intended users. The report is prepared for restricted use under its terms.

Our Engagement Process

Readiness assessment

Understand the system, scope, control environment and readiness considerations.

Control design

Clarify control objectives and documentation needs, subject to independence requirements.

Fieldwork and testing

Gather evidence and evaluate controls against the agreed criteria and scope.

Reporting

Conclude the examination and issue a report for its specified users and permitted purpose.

Readiness or control design support must be scoped to preserve the practitioner’s independence. Where needed, these activities should be performed by a separate advisor.

Type I vs Type II

Type I

Evaluates whether the relevant controls are suitably designed and implemented as of a specified date. It is a point-in-time view.

Type II

Evaluates control design and whether the controls operated effectively over a defined period. It requires evidence from across that period.

Engagements are performed for clients in India and the United States, subject to applicable professional standards, jurisdictional requirements and independence considerations.

Discuss an engagement