It is management's own representation, signed by the service organization, and the auditor's report gives an opinion on it. Under the inclusive method a subservice organization provides an assertion of its own.
It sits alongside the system description and the auditor's opinion.
Read more
Related terms
- System description
- The system description is management's account of the system a SOC 2 covers, written against the AICPA DC 200 description criteria.
- Qualified opinion
- A qualified opinion is an auditor's opinion that the controls met the criteria except for specific matters described in the report.