Glossary · SOC and attestation
The system description is the one part of a SOC report you write yourself.
Management's written account of the service under examination: its boundary, components, controls, vendors and customer responsibilities, which the CPA firm then tests for accuracy.
Back to the glossary01 · In plain words
In plain words
Management's written account of the service under examination: its boundary, components, controls, vendors and customer responsibilities, which the CPA firm then tests for accuracy.
A SOC report has an opinion from the CPA firm, an assertion from management, and a long section in the middle that explains what the system is. That middle section is the system description. Management drafts it, and the examiner checks that it is accurate and leaves nothing important out.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Readers of a SOC report rarely start with the test results. They read the description to learn what the service actually includes: which products, which locations, which data, which vendors. If the description claims a control that does not exist, or hides a material incident, the examiner can qualify the opinion on the description itself. For a SOC 2, the description is measured against the AICPA description criteria (DC 200); for a SOC 1, against the requirements in AT-C 320.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Section 3 of a SOC report
- Usually titled as management's description of the system, often the longest section.
- The management assertion
- Management states that the description is fairly presented.
- The service auditor's opinion
- The first paragraph of the opinion covers whether the description is fair.
- A customer's vendor review
- Buyers read it to see whether the product they bought is inside the boundary.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a scheduling platform overstates its access reviews
A clinic-scheduling SaaS in Ahmedabad drafts its description from a template that says user access is reviewed quarterly. In practice reviews ran twice in the year. During testing the examiner finds the gap. The company rewrites the paragraph to say what it really does, and adds a semi-annual review that the examiner can sample. Had the template wording stayed, the description would have misstated the control, and the opinion could have said so.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Audit scope
- The agreed boundary of the engagement. The description is the written account of what sits inside that boundary.
- Management assertion
- A short signed statement. The description is the long narrative the assertion refers to.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Draft the description from how the system really runs, not from a template.
- Name every subservice organization and every complementary user entity control.
- Disclose significant incidents and system changes in the period, if any.
- Have each control owner confirm the sentences that describe their control.
- GuideWriting the system descriptionA drafting workflow for the description, from facts to a review loop.
- GuideDC 200: what a system description is measured againstThe description criteria, and how an auditor tests a description.
- GuideThe SOC 1 system descriptionWhat the description must say, and how it is tested.
Sources: AICPA DC 200, 2018 Description Criteria for a Description of a Service Organization's System in a SOC 2 Report; AICPA AT-C sections 205 and 320.
Questions about System description
Who writes the system description?
Management, often with help from an adviser.
The description is management's document. An adviser such as Auditify can help structure and draft it; the CPA firm then tests it independently and cannot be its author.
Can the description change during the period?
Yes, but changes must be described.
If the system changed materially during a Type 2 period, the description should say what changed and when, so readers know which controls applied at which time.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.