Glossary · SOC and attestation
Points of focus are prompts for thinking, not a list to tick off.
Short descriptions under each Trust Services Criterion of the characteristics a control environment often has, published to guide judgment rather than to be required one by one.
Back to the glossary01 · In plain words
In plain words
Short descriptions under each Trust Services Criterion of the characteristics a control environment often has, published to guide judgment rather than to be required one by one.
Each Trust Services Criterion states a goal in a sentence or two. Under it the AICPA lists points of focus: typical things an organization does to meet that goal. They help you think, but you do not have to address every one.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
A common mistake in a first SOC 2 is treating every point of focus as a control to build. That inflates the control set, adds evidence nobody needs and can still miss what matters for your system. The criteria themselves are what the auditor reports against. Points of focus help you and the auditor judge whether your controls cover the intent of a criterion, and they make good prompts for a readiness review. When one does not fit your business, you can leave it aside, though it is wise to know why. The AICPA revised the points of focus in 2022 while keeping the 2017 criteria in place.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- TSP section 100
- The AICPA's Trust Services Criteria document, where each criterion is followed by its points of focus.
- A readiness or gap assessment
- Consultants use the points to ask whether a criterion is covered from several angles.
- The control matrix
- Some teams map each control to the points it helps address, to show coverage.
- Auditor walkthroughs
- An auditor may use a point of focus as a question when a control's link to a criterion is unclear.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an online tutoring company and the risk criteria
An edtech company serving schools reads the points of focus under the risk assessment criteria. One mentions considering fraud risk. The team first plans a full fraud programme. On reflection, it adds fraud scenarios, such as staff altering grades or refund records, to its existing annual risk assessment and records why other fraud points are low risk for its business. The criterion is covered, and the control set stays the right size.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Trust Services Criteria
- The criteria are what the auditor reports against. Points of focus sit under them as guidance.
- Controls
- Controls are what your company does. Points of focus describe what organizations often do, in general terms.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Read the points of focus for each in-scope criterion during readiness, not after the audit starts.
- Use them as questions: for each one, note whether you address it, and if not, why it does not apply.
- Design controls around your real risks, then check coverage against the points.
- Confirm with your CPA firm which version of the points of focus it will use.
- GuideTSP 100: how the criteria document is builtCategories, criteria and points of focus, and why the 2017 set still applies.
- GuideTrust Services CriteriaThe five categories, with CC1 to CC9 read as questions your controls answer.
- GuideThe SOC 2 controls listNo official list. Example controls grouped by the team that owns them.
Sources: AICPA TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022).
Questions about Points of focus
Will the auditor fail us for skipping a point of focus?
Not by itself.
The opinion is about the criteria. A skipped point matters only if it leaves a criterion not met. Keep a short reason for each point you treat as not relevant, so the conversation is quick.
Did the 2022 update change the criteria?
It revised the points of focus, not the criteria.
The AICPA published revised points of focus in 2022 alongside the 2017 Trust Services Criteria. The criteria themselves stayed the same.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.