AUD — Quick Sheet
Attestation & SOC Engagements
Read time: ~5 minutes
One-minute revision
- Examination = opinion (reasonable); Review = conclusion (limited); AUP = findings (none)
- SOC 1 = ICFR-relevant controls (for user auditors); SOC 2 = Trust Services Criteria (restricted); SOC 3 = general use summary
- Trust Services Criteria: security (always required), availability, processing integrity, confidentiality, privacy
- Type 1 = design at a point in time; Type 2 = design + operating effectiveness over a period
- Only Type 2 supports reliance on controls for a period
- Check complementary user entity controls actually exist at the user entity