AT-C section 105

AT-C 105: the vocabulary every SOC 2 is built from.

Q: Could our board engage the CPA firm instead of management?

Yes, the engaging party can differ. AT-C 105 recognizes an engaging party separate from the responsible party. In practice most SOC 2s are engaged by management itself, and management still gives the assertion.

Q: Can we write our own criteria for a SOC 2?

Not for the core report. A SOC 2 uses the AICPA's TSP 100 and DC 200. You write your own controls to meet those criteria; the criteria themselves are fixed.

AT-C section 105, Concepts Common to All Attestation Engagements, sets out the parties, the ideas and the conditions that apply to every attestation engagement, SOC 2 included. Learn its ten or so terms and the rest of the process stops sounding like jargon.

Back to SOC 2 services

01 · What it does

The section every other section leans on

AT-C 105 always applies together with a level-of-service section such as AT-C 205.

The attestation standards are built in layers. AT-C 105 holds what is common to all engagements: who the parties are, what makes criteria acceptable, what independence means, and when a CPA may take an engagement on. The examination section then adds the steps for giving an opinion. In a SOC 2, both apply at once.

Throughout this page, the example is an illustrative company: a payroll software provider seeking its first SOC 2 Type 2 on Security and Confidentiality.

02 · The parties

Who is who in the engagement

Three roles that can sit with two organizations.

Practitioner: The CPA performing the engagement. In the example, the CPA firm engaged to examine the payroll provider.
Responsible party: The party responsible for the subject matter. Here, the payroll provider's management, who run the system and its controls.
Engaging party: Whoever engages the practitioner. Usually the same management. It could be different, for example a parent company commissioning the report for a subsidiary.
Intended users: Those the report is for: the payroll provider's customers and their advisers who understand the system. This is why a SOC 2 is restricted in use.

Why the roles must stay apart

The practitioner can never be the responsible party. If the CPA firm designed and ran your controls, it would be examining its own work, and the engagement fails before it starts.

03 · Subject and criteria

Subject matter, criteria and what makes criteria suitable

The thing measured, and the ruler. The ruler must be suitable and available.

The subject matter is what the report is about. In a SOC 2 it is the description of the system and the design and operation of its controls. The criteria are the benchmarks used to measure it: the description criteria (DC 200) and the trust services criteria (TSP 100).

Characteristic of suitable criteria	What it means	How it shows in the payroll example
Relevance	Results help users make decisions	Criteria about protecting confidential salary data matter to customers
Objectivity	Free from bias	The criteria don't favour the payroll provider over its customers
Measurability	Allow reasonably consistent measurement	Two competent CPAs would reach similar conclusions
Completeness	Nothing left out that would change a user's view	The criteria cover access, change, operations and risk, not just a slice

Criteria must also be available to intended users, for example because they are published, as the AICPA's criteria are, or because they are set out in the report itself.

04 · Assertion and evidence

Assertion, evidence, skepticism and judgment

Management makes a claim; the practitioner tests it with an open but doubting mind.

Assertion: A statement by the responsible party about the subject matter measured against the criteria. In the example: management states that its description is fairly presented and its controls were suitably designed and operated effectively over the period.
Evidence: Information the practitioner uses to reach a conclusion. It must be sufficient (enough of it) and appropriate (relevant and reliable). A dated access review in the identity provider is better evidence than a policy saying reviews happen.
Professional skepticism: An attitude that questions and stays alert to contradictory evidence. If a ticket shows approval after the change went live, the practitioner asks why rather than accepting the screenshot.
Professional judgment: Applying training and experience to decide what is enough, for example how large a sample a quarterly control needs.

05 · Independence

Independence and ethics

The practitioner must be independent of the responsible party and follow the AICPA's code.

AT-C 105 requires the practitioner to be independent and to comply with the AICPA Code of Professional Conduct. It also links the engagement to the firm's quality management system, a link that SSAE 23 tightened for engagements starting from 15 December 2025.

One firm writes and examines. Drafting your policies and then examining them puts the CPA on both sides.
Operating a control for you. If the examiner's staff run your access reviews, they would be testing their own work.
Treating readiness and audit as one contract. Keep the adviser who prepares you separate from the firm that examines you.

06 · Acceptance

Before the engagement is accepted

The preconditions a CPA must see before signing an engagement letter.

Independence. The firm is independent of the payroll provider.
Responsibility accepted. Management takes responsibility for the system, its description and its controls.
Appropriate subject matter. The system can be identified and measured consistently against the criteria.
Suitable, available criteria. TSP 100 and DC 200, used as intended.
Access to evidence. The firm expects to get the evidence and people it needs.
Agreed terms. The terms are written in an engagement letter, including the written assertion management will give.

Sources: AICPA SSAE No. 18, AT-C section 105, Concepts Common to All Attestation Engagements, as amended (including SSAE No. 19 and SSAE No. 23); AICPA SOC 2 guide; AICPA Code of Professional Conduct. Examples are illustrative.

Questions about AT-C 105

Who is the responsible party in our SOC 2?

Your management.

Management is responsible for the system, the description and the controls, and signs the assertion. Your customers are intended users, not responsible parties.

Could our board engage the CPA firm instead of management?

Yes, the engaging party can differ.

AT-C 105 recognizes an engaging party separate from the responsible party. In practice most SOC 2s are engaged by management itself, and management still gives the assertion.

Why does the auditor keep asking how we know a list is complete?

Evidence must be sufficient and appropriate.

A sample drawn from a partial list cannot support a conclusion about the whole period. Asking how a population was produced is ordinary skepticism, not distrust.

Can we write our own criteria for a SOC 2?

Not for the core report.

A SOC 2 uses the AICPA's TSP 100 and DC 200. You write your own controls to meet those criteria; the criteria themselves are fixed.

Walk into the engagement knowing the terms.

Our readiness work maps your team, your system and your evidence to the AT-C 105 roles before the CPA firm's first request.

Get a SOC 2 readiness assessment Book a free consultation Back to SOC 2 services