Reviewed October 30, 2026. Originally published in the SSAE 16 terminology series.
Criteria are the standards or benchmarks used to evaluate the subject matter of an attestation engagement. A control is an activity or mechanism designed to address a relevant risk and support the organization’s objectives.
The distinction matters when you prepare a report. A criterion tells you what the evaluation is against; it does not necessarily prescribe one technology, form, or review frequency.
A Simple Example
Consider a SOC 2 access-control requirement. The organization might use an approval process to limit access to authorized responsibilities.
- Criterion: access is authorized and adjusted to roles, with least privilege considered (a plain-language example).
- Control activity: an authorized reviewer approves access before it is granted.
- Evidence: the request, approval, and record showing the permissions implemented.
The exact activity and evidence depend on the system and its risks. A sample monthly review or firewall rule is not automatically a requirement for every organization.
SOC 1 control objectives should also be distinguished from the activities designed to achieve them. Management needs to explain that relationship in the context of the service being reported on.
The AICPA SOC resource library provides the Trust Services Criteria and reporting guidance. Use the applicable criteria for your engagement rather than relying on a generic control list.