SOC 1, SOC 2 and SOC 3 examinations are attestation engagements under AICPA standards, and the ISAE standards play the same role internationally. The output is a report with an opinion, which is why SOC 2 is described as a report rather than a certificate.
Compare ISO 27001, which certifies a management system.
Read more
Related terms
- SOC 2
- SOC 2 is an attestation report in which a CPA firm gives an opinion on a service organization's controls against the AICPA Trust Services Criteria.
- ISAE 3000
- ISAE 3000 is the IAASB's international standard for assurance engagements on subject matter other than historical financial information.
- Qualified opinion
- A qualified opinion is an auditor's opinion that the controls met the criteria except for specific matters described in the report.