An attestation puts an independent accountant's name behind somebody else's claim.

Your company says something about its own systems: these controls exist, and they worked all year. An attestation is a licensed accountant checking that statement against agreed rules and putting a conclusion in writing. The accountant does not own the controls. You do. The accountant only says whether your account of them holds up.

Buyers rarely trust a vendor's self-description, and they cannot audit every vendor themselves. An attestation solves that by moving the checking to an independent practitioner who is bound by professional standards, independence rules and peer review. Every SOC report is an attestation, which is why a SOC 2 is never a certificate and never a pass mark. For a founder, the practical point is wording: you can say you hold a report from a named CPA firm; you cannot say you are certified. For an auditor, it sets the limits of the job, since the opinion covers only the subject matter and criteria named in the engagement.

The engagement letter

Names the subject matter, the criteria, the type of engagement and who is responsible for what. Read it before fieldwork starts.

The independent service auditor's report

Section 1 of a SOC report. It carries the opinion, the scope and any modification.

Sales and procurement calls

Where buyers ask whether you have an attestation, often meaning a SOC 2 Type 2.

Your website trust page

Where loose words like certified or compliant creep in and need correcting.

Certification

A certification body declares that a management system conforms to a standard, as with ISO 27001. An attestation is an opinion on a subject matter against criteria, with no certificate and no ongoing registration.

Readiness or gap assessment

Advice on where you stand, produced by anyone, often the people helping you build controls. It carries no independent opinion and buyers should not treat it as one.

• Check which engagement your buyer actually wants: an examination such as SOC 2, or something narrower.
• Reword any public claim that says certified or SOC 2 compliant to name the report and the issuing firm instead.
• Keep whoever advises you separate from the CPA firm that attests, so independence is never in doubt.

• GuideA SOC 2 attestation, explainedWhat an attestation is, who may give one, and what you may call the result.
• GuideAT-C 105: ideas behind every attestationPractitioner, subject matter, criteria, assertion: the vocabulary of every report.
• GuideThe AICPA attestation standards, mappedHow SSAE 18, the AT-C sections and the SOC suites fit together.

Sources: AICPA SSAE 18 and later amendments; AT-C section 105 (Concepts Common to All Attestation Engagements); AT-C sections 205, 210 and 215; AICPA SOC suite descriptions.