AT-C section 205
AT-C 205: the examination behind every SOC 2 opinion.
AT-C section 205, Assertion-Based Examination Engagements, is the section that turns evidence into an opinion with reasonable assurance. Every SOC 2 and SOC 3 runs on it. Knowing its steps explains the order, and the requests, of your fieldwork.
Back to SOC 2 services01 · Level of service
An examination, not a review or a set of procedures
The highest level of assurance in the attestation standards.
| Engagement | Section | Assurance | Output |
|---|---|---|---|
| Assertion-based examination | AT-C 205 | Reasonable | An opinion on management's assertion or the subject matter |
| Direct examination | AT-C 206 | Reasonable | An opinion, with no assertion from the responsible party |
| Review | AT-C 210 | Limited | A conclusion |
| Agreed-upon procedures | AT-C 215 | None | Findings only |
SOC 2 is an assertion-based examination: management gives a written assertion, and the CPA firm examines it. That is why Section 2 of the report exists.
02 · The phases
The phases of an examination
Six phases defined by the standard, not by a project plan.
Accept and agree terms
Preconditions met, terms written down.
- What happens
- Checks independence and the AT-C 105 preconditions
- Agrees the engagement letter, including the assertion management will give
- You get
- A signed engagement letter
- A defined system and period
- Good practice
- Scope and categories settled before planning starts
- Watch for
- Changing the system boundary mid-engagement without telling the firm
Plan and understand
The firm learns the system before it tests it.
- What happens
- Sets the overall strategy and timing
- Obtains an understanding of the system, its controls and its environment
- You get
- Walkthroughs
- Document and evidence requests
- Good practice
- One owner per control ready to explain it
- Watch for
- Walkthroughs led by someone who doesn't run the control
Assess risk and set materiality
Where could the assertion be wrong?
- What happens
- Identifies and assesses risks of material misstatement
- Considers materiality, quantitative and qualitative
- You get
- A risk-based test plan
- Good practice
- Disclosing known weaknesses early
- Watch for
- Hiding incidents the firm will find anyway
Gather evidence
Procedures that respond to the assessed risks.
- What happens
- Inquiry, observation, inspection and re-performance
- Tests populations for completeness before sampling
- You get
- Sample requests
- Follow-up questions on deviations
- Good practice
- Evidence pulled from the system that does the work
- Watch for
- Screenshots recreated after the fact
Obtain written representations
Management confirms, in writing, what it has told the firm.
- What happens
- Requests a representation letter dated near the report date
- You get
- A letter for management to sign
- Good practice
- Checking every statement before signing
- Watch for
- Signing representations you have not verified
Evaluate and report
From results to an opinion.
- What happens
- Evaluates misstatements and deviations
- Forms the opinion and drafts the report
- You get
- A draft report for factual review
- Good practice
- Reading the description and test results line by line
- Watch for
- Arguing the opinion instead of fixing facts
03 · Materiality
Materiality without a dollar figure
In a SOC 2, materiality is mostly qualitative.
AT-C 205 asks the practitioner to consider materiality: whether a misstatement, including an omission, could reasonably be expected to influence the decisions of intended users. SSAE 20 updated how that concept is described. A SOC 2 has no revenue figure to anchor it, so the firm weighs the nature of a problem as much as its size.
- Nature of the controlA gap in privileged access weighs more than a late policy acknowledgement.
- Rate of deviationOne miss in a large sample differs from three in a small one.
- CauseA one-off human error differs from a control that was never designed to run.
- Effect on usersWould a customer relying on the report decide differently if they knew?
04 · The opinion
Forming the opinion, and when it is modified
Four outcomes, set by how serious and how widespread the problem is.
- A title that includes the word independent.
- To whom the report is addressed.
- The subject matter, the criteria and management's assertion.
- Management's responsibilities and the practitioner's responsibilities.
- A statement that the examination followed AICPA attestation standards, and that the firm is independent.
- The inherent limitations, and any restriction on use.
- The opinion itself, then the firm's signature, city and state, and date.
The list above is the shape of the report elements AT-C 205 requires. The SOC 2 guide adds the description, the tests and the results for a Type 2.
05 · SOC 2 fieldwork
How SOC 2 fieldwork maps onto AT-C 205
Every request you receive traces back to a step in the standard.
| What you experience | The AT-C 205 step behind it |
|---|---|
| Engagement letter naming the system, categories and period | Acceptance and agreed terms |
| Kick-off call and walkthroughs | Understanding the subject matter |
| Questions about past incidents and recent changes | Assessing risks of material misstatement |
| Requests for full lists of users, changes and tickets | Evidence: testing population completeness |
| Sample selections and follow-up questions | Evidence: tests of operating effectiveness |
| A representation letter to sign | Written representations |
| A draft report for factual review | Evaluating results and forming the opinion |
When representations are refused
If management will not give the assertion or the written representations, the standard does not let the firm simply carry on. It must consider withdrawing or disclaiming. Refusing to sign is never a negotiating tool.
Sources: AICPA SSAE No. 18, AT-C section 205, as revised by SSAE No. 20 (materiality) and SSAE No. 21 (assertion-based examinations); AICPA Professional Standards index; AICPA SOC 2 guide. Examples are illustrative.
Questions about AT-C 205
Why does a SOC 2 need a management assertion at all?
Because it is an assertion-based examination.
AT-C 205 examines a claim made by the responsible party. The assertion is that claim. Without it, the engagement would have to be a different kind, such as a direct examination.
Is “reasonable assurance” the same as a guarantee?
No.
It is a high but not absolute level of assurance. Sampling, judgment and the limits of any control mean an examination can never rule out every error.
Does a deviation automatically change the opinion?
No. It is evaluated first.
The firm considers the nature, cause and extent of a deviation. Many deviations are reported in Section 4 with an unmodified opinion; only material ones lead to modification.
Did SSAE 21 change how our SOC 2 is run?
Not in any way a company would notice day to day.
SSAE 21 revised the assertion-based examination section and added direct examinations. A SOC 2 remains an assertion-based examination under AT-C 205.
Know what each request is for.
We prepare your team for every AT-C 205 step, from walkthroughs to the representation letter.