The report
The management assertion: what leadership is putting its name to.
Before the CPA firm signs anything, management signs a written assertion: that the system description is fair and that the controls did their job. The opinion that follows is about those claims. A leader who signs without knowing what backs them is vouching for work they have never looked at.
Back to SOC 2 services01 · The claims
What the assertion actually claims
Three core claims, plus the assumptions they rest on.
- 1Fair presentationThe system description is presented in accordance with the description criteria (DC 200).
- 2Suitable designThe controls were suitably designed to give reasonable assurance that service commitments and system requirements would be achieved under the applicable criteria.
- 3Operating effectiveness (Type 2)The controls operated effectively throughout the stated period.
- +The assumptionsThat CUECs and, under carve-out, CSOCs at subservice organizations operated as the design assumes.
02 · Who signs
Who signs it, and on whose behalf
A named leader, for the organization.
The assertion is made by management of the service organization. In practice a senior leader with authority over the system signs it, often the chief executive, chief technology officer or head of security. Some organizations have more than one signatory.
- The assertion
- Included in the report. Customers read it.
- The representation letter
- A separate letter to the CPA firm, not in the report, confirming management has provided all relevant information and disclosed known deviations, incidents and changes.
Both letters carry real weight. The representation letter is where management tells the auditor it has disclosed everything relevant, including things the auditor did not find.
03 · Why it matters
Why the signer should know what they are signing
The auditor examines your claim. You make it.
A signature is not a formality
Customers rely on the assertion in their own risk decisions. A leader who signs a claim the organization cannot support carries that statement personally and commercially, whatever the auditor concludes.
- It confirms the boundary in the description is the real one.
- It confirms no significant incident or change has been left out.
- It confirms controls ran across the whole period, not just near the end.
04 · What backs it
What backs the assertion in practice
A signer should be able to point to each of these.
- Ongoing monitoringDashboards, alerts and periodic checks that show controls running through the period.
- Internal reviewA pre-fieldwork look, internal or by an adviser, at each control's evidence.
- Control-owner sign-offsEach owner confirms in writing that their controls ran as described, and lists any misses.
- Vendor report reviewsSubservice organizations' reports read, gaps noted and CSOCs checked.
- Incident and change logsReconciled against what the description says.
05 · When you can't
When management can't support part of it
The assertion changes to match reality. It is never signed as if things were fine.
| Situation | What changes in the assertion | Likely effect on the report |
|---|---|---|
| A control missed a few occurrences | Usually nothing; deviations appear in the tests section | Exceptions noted; the opinion may stay unmodified |
| A control never operated in part of the period | The assertion describes the failure and the criteria affected | The opinion is likely to be modified for those criteria |
| The description includes something that isn't real | Fix the description before signing | Unfixed, the opinion on the description is at risk |
| A significant incident occurred | Disclose it in the description | Assessed by the auditor like any other fact |
Illustrative only. Whether an issue changes the opinion is the CPA firm's judgement. What management controls is honesty and timing: raise problems early, while there is still room to fix or disclose them properly.
06 · Before signing
A checklist to run before signing
Ten minutes of questions that save a difficult conversation later.
- Boundary. Have I read the system description, and does it describe the system we actually run?
- Period. Do the dates in the assertion match the examination period?
- Changes. Are all significant changes in the period disclosed?
- Incidents. Are significant incidents disclosed and handled as the description says?
- Deviations. Have control owners told me about every known miss, and has the auditor heard about each one?
- Vendors. Have we reviewed the reports of the subservice organizations we rely on?
- CUECs. Is every CUEC really something only a customer can do?
Sources: AICPA attestation standards AT-C section 105 and AT-C section 205 (assertions and written representations); DC section 200 description criteria; TSP section 100, 2017 Trust Services Criteria; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization.
Questions about the management assertion
Can our readiness adviser sign the assertion for us?
No. Only management can make management's claims.
An adviser can help prepare the description and walk the signer through the evidence. The assertion is a statement by the organization, and only its own leadership can make it.
Is the assertion the same every year?
The shape is. The facts behind it are new.
The wording follows a familiar pattern, but each period has its own changes, incidents and deviations. Re-run the pre-signing checklist every time rather than re-using last year's confidence.
What if the signer leaves before the report is issued?
Another member of management signs.
The assertion belongs to the organization. A successor with the right authority signs, after doing the same review. Mention the change to the CPA firm early.
Does a bridge letter extend the assertion?
No. It is a new, separate statement by management.
A bridge letter covers the time after the period ends. It is management's word alone, with no examination behind it, and it should be just as carefully checked before signing.
Sign with evidence behind you.
A SOC 2 readiness assessment builds the monitoring and owner sign-offs that let leadership sign the assertion with confidence.