Glossary · SOC and attestation
The management assertion puts leadership's name on the claim before the auditor speaks.
A signed statement by service organization management: the system is described honestly, the controls were designed to do their job and, for Type 2, ran effectively throughout the period.
Back to the glossary01 · In plain words
In plain words
A signed statement by service organization management: the system is described honestly, the controls were designed to do their job and, for Type 2, ran effectively throughout the period.
Before an auditor gives an opinion, the company has to say what it believes is true. The management assertion is that statement, in writing, signed by someone senior. The auditor's job is then to test whether the claim holds.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Attestation work rests on a simple split: management makes a claim, and an independent practitioner reports on it. Without a signed assertion there is nothing for the auditor to examine, so the engagement cannot finish. For a founder, the assertion is also a personal moment of accountability. By signing, that person assures every reader of the report that the system description can be relied on and that the controls did what the company says they did. If a known incident, a missed control or a carved-out vendor is left unsaid, the signature is on an untrue statement. That is why the assertion should be drafted alongside the description, not pasted in at the end.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Section 2 of a SOC 2 or SOC 1 report
- The assertion usually sits right after the auditor's opinion, on company letterhead, with the signer's name and title.
- The management representation letter
- A separate letter to the auditor near the end of fieldwork, confirming that nothing material was withheld. Related, but not printed in the report.
- The closing meeting with the CPA firm
- Wording of the assertion is agreed here, especially if exceptions or a qualified opinion change what management can claim.
- The board or leadership sign-off
- Some companies table the draft assertion with leadership so the signer is not the only one who has read it.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a freight-tracking platform's finance head signs
A logistics software company in Chennai reaches the end of its first Type 2 period. The draft assertion says all controls operated effectively. During fieldwork the auditor found that two leavers kept warehouse-portal access for three weeks. The finance head, who is due to sign, asks the team to revise the description and assertion so the deviation is acknowledged and the remediation is described. The auditor then reports on an assertion that matches the evidence, and no reader later finds a gap between what the company said and what the tests showed.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Management representation letter
- A private letter to the auditor about what was disclosed during the engagement. The assertion is public within the report and speaks about the system itself.
- Auditor's opinion
- The opinion is the auditor's conclusion. The assertion is the company's own claim that the opinion is about.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Name the signer early, and make sure that person reads the system description, not only the assertion.
- Draft the assertion from the description and the test results, then revise it if exceptions appear.
- Keep a short log of incidents and changes during the period so nothing is missing when the assertion is signed.
- Ask the CPA firm for its expected assertion format before fieldwork closes.
- GuideThe management assertionWhat leadership is signing, and what backs it.
- GuideAT-C 105: ideas behind every attestationPractitioner, subject matter, criteria, assertion: the vocabulary of every report.
- GuideWriting the system descriptionA drafting workflow for the description, from facts to a review loop.
Sources: AICPA SSAE 18, AT-C section 105 (concepts common to attestation engagements), AT-C section 205 (examination engagements) and AT-C section 320 (service organization controls); AICPA DC 200 description criteria.
Questions about Management assertion
Who should sign the management assertion?
A senior officer who can speak for the system.
Commonly a chief executive, chief technology officer or chief operating officer signs on behalf of the company. The point is that the signer has the authority and the knowledge to stand behind the description and the controls. The CPA firm will say what it expects.
Can the assertion be changed after fieldwork?
Yes, until the report is issued.
If testing turns up exceptions, management usually revises the description and the assertion so they match. Once the report is issued, the signed assertion is part of it and cannot be edited.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.