The attestation mechanism
A SOC 2 attestation, taken apart.
A SOC 2 report is the written result of an attestation engagement: a licensed CPA firm examines statements your management makes about its own system and controls, then gives an independent conclusion on them. This page explains how that machine works, who is allowed to run it, and the vocabulary that keeps your claims accurate.
Back to SOC 2 services01 · What attesting means
Attesting means concluding on someone else's statement
The CPA firm does not describe your system. It tests what management says about it.
In the AICPA's professional standards, an attestation engagement has a fixed shape. There is a subject matter (your system and its controls), a set of criteria to measure it against, a responsible party (your management) and an independent practitioner (the CPA firm). Management makes a written assertion about the subject matter. The practitioner gathers evidence and reports whether that assertion holds, measured against the criteria.
For SOC 2, the criteria come in two sets. The description criteria (DC section 200) say what a fair system description must contain. The Trust Services Criteria (TSP section 100) say what the controls must achieve. The CPA firm's opinion covers both: was the description fairly presented, were the controls suitably designed and, in a Type 2, did they operate effectively across the period.
The one-sentence version
Management says “this is our system, and these controls meet these criteria”; a licensed CPA firm says, after testing, whether that statement is fairly stated in all material respects.
02 · Three engagement levels
Examination, review, agreed-upon procedures
SOC 2 sits at the highest of three attestation levels.
| Engagement | Standard | What the reader gets |
|---|---|---|
| Examination | AT-C 205 | An opinion with reasonable assurance. This is the level a SOC 2 report uses. |
| Review | AT-C 210 | A conclusion with limited assurance, based mainly on inquiry and analysis. Not used for SOC 2. |
| Agreed-upon procedures | AT-C 215 | A list of procedures and findings, with no opinion at all. Sometimes used for narrow vendor checks. |
Reasonable assurance is high but not absolute. It is the same level of assurance a financial statement audit gives, which is why the examination is the form buyers trust.
03 · Who may attest
Who is allowed to give the conclusion
Only a licensed CPA firm that is independent of you.
- Licensed to perform attest work. Attest services are a regulated activity for CPA firms; a security consultancy, software vendor or certification body cannot sign a SOC 2 opinion.
- Independent of the subject matter. The firm cannot have designed, run or owned the controls it is testing.
- Subject to quality control. Firms performing attest work are expected to operate a quality management system and, in the US, take part in peer review.
- Competent in the subject. The engagement team must understand the technology it tests, often with IT specialists on the team.
This is why a readiness adviser and the examiner are different firms. A consultancy such as Auditify can help you design controls and prepare evidence. It cannot then attest to them, and a CPA firm that built your controls could not either.
04 · Words to use
What you may call the result
Say report or attestation. Never say certificate or certified.
Accurate
- “We have a SOC 2 Type 2 report covering [period].”
- “Our controls were examined by an independent CPA firm.”
- “We completed a SOC 2 attestation with an unmodified opinion.”
Inaccurate
- “We are SOC 2 certified.”
- “Our SOC 2 certificate is attached.”
- “We are SOC 2 compliant forever.” (an opinion covers a stated date or period)
Whether a certificate exists at all is covered on the certificate page. The point here is that the wording follows from the mechanism: an opinion on an assertion is not a certification of a thing.
05 · Versus other audits
How it differs from certification and from a financial audit
Same profession as a financial audit, different subject matter and standards.
| SOC 2 examination | Financial statement audit | Certification (e.g. ISO/IEC 27001) | |
|---|---|---|---|
| Who performs it | Licensed CPA firm | Licensed CPA firm | Accredited certification body |
| Standards followed | AICPA attestation standards (AT-C) | Auditing standards (AU-C, or PCAOB for US public companies) | ISO/IEC 17021-1 and the management system standard |
| Subject matter | A service system and its controls | Financial statements | A management system |
| Output | Report with an opinion, restricted use | Auditor's report on the accounts | Certificate, publicly verifiable |
06 · Vocabulary
The vocabulary a reader needs
Ten terms that unlock any SOC 2 report.
- Service organization
- You: the company whose system is examined.
- User entity
- Your customer, who relies on your system.
- Service auditor
- The CPA firm performing the examination.
- Subservice organization
- A vendor that performs part of your service for you.
- Management's assertion
- Management's signed statement that the description and controls meet the criteria.
- Description criteria
- DC 200: what a fair description of the system must include.
- Trust Services Criteria
- TSP 100: the outcomes controls must achieve, by category.
- Unmodified opinion
- The clean result: no material problem found with the assertion.
- Complementary User Entity Controls (CUECs)
- Controls the system assumes customers operate.
- Complementary Subservice Organization Controls (CSOCs)
- Controls the system assumes carved-out vendors operate.
Sources: AICPA attestation standards AT-C section 105 (concepts common to all attestation engagements), AT-C 205, 210 and 215; AICPA description criteria DC section 200; AICPA Trust Services Criteria TSP section 100 (2017, revised points of focus 2022); AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization.
Questions about the attestation itself
If the CPA firm gives the opinion, why does our management sign anything?
Because the opinion is about management's statement.
An attestation needs a responsible party whose claim is being tested. Management's assertion is that claim. Without it there is nothing for the practitioner to conclude on, and the engagement cannot be performed as an examination.
Does an unmodified opinion mean the auditor found nothing wrong?
No. It means nothing material was found.
A Type 2 report can list individual test exceptions and still carry an unmodified opinion, if the exceptions did not stop the criteria being met. Read Section 4 for the detail.
Can our security consultant also be our SOC 2 examiner?
Not if they helped build what is being tested.
Independence rules stop a firm from attesting to controls it designed or operated. Use one firm to prepare and a separate licensed CPA firm to examine.
Is a SOC 2 opinion valid for a fixed time?
No expiry date is set by the standards.
The opinion covers a date (Type 1) or a period (Type 2). Buyers decide how old a report they accept; that practice is covered on the report validity page.
Get the mechanism right, then the wording follows.
We prepare your system description, your assertion and your evidence so the CPA firm's examination has something solid to test.