Corrected October 30, 2026. The original publication date is retained.
Management needs to provide information relevant to the system description, assertion and controls being examined, along with access to appropriate personnel. The exact requests depend on the report type, scope and period. Agree on the request process and secure sharing method with the CPA firm early.
What Records Are Usually Relevant?
- The system description, management assertion and supporting policies or procedures.
- Records showing how relevant controls were designed and implemented; for Type 2, evidence of operation during the period.
- Relevant agreements, system inventories and information about subservice organizations.
- Complete populations or listings from which the auditor can select items, with context explaining their source.
- Written management representations and additional information requested for the engagement.
Example Scenario: For an access review, a policy describes the intended activity. The access listing, reviewer decisions, correction tickets and completion records help show what actually happened. A policy alone does not demonstrate that the review operated.
Who Will the Auditor Need to Speak With?
The auditor may need to speak with people who perform, approve or oversee the controls. Assign request owners and arrange access to relevant staff. If an owner cannot explain a record, resolve that gap rather than supplying a file without context.
How Should Sensitive Evidence Be Handled?
Use approved transfer channels and limit access to those who need it. Discuss sensitive records, retention, permitted access and any proposed redaction with the auditor before withholding or altering evidence. Preserve the information needed to support the examination.
Do not assume evidence can never be seen beyond the testing team. Professional and legal obligations, quality reviews and agreed service arrangements can affect access. Confirm handling expectations in the engagement terms. As one example, the Washington accountancy confidentiality rule includes exceptions; requirements depend on the applicable circumstances.
What Appears in the Report?
A SOC report is not simply a pass/fail scorecard. It contains the applicable opinion and reporting components. A Type 2 report includes descriptions of tests and results, which can include exceptions. Read those findings in the context of the scope and opinion rather than assuming every exception has the same effect.
Keep a request list with an owner, due date, evidence location and follow-up status. Record gaps honestly; do not recreate historical evidence to make a missed activity appear completed. The AICPA SOC resource library provides management and report-user guidance.
One Response