SOC Communication & Stakeholder Relations 2

Question 1

Under SOC 2, which section of the report is specifically dedicated to communicating the service organization's description of its system?

Accepted Answer

Section II – Management's Description

Answer

Section II of a SOC 2 report contains management's written description of the service organization's system, including its boundaries and controls.

Question 2

A user entity receives a SOC 2 Type II report but cannot share it with its own customers due to confidentiality restrictions. What is the most appropriate way to address stakeholder inquiries?

Accepted Answer

Provide a summary of key findings without distributing the full report

Answer

User entities may share summarized conclusions or relevant excerpts while honoring the confidential distribution restrictions common to SOC 2 reports.

Question 3

Which stakeholder group is the PRIMARY intended audience for a SOC 1 report?

Accepted Answer

User entities and their financial statement auditors

Answer

SOC 1 reports are designed for user entities and their financial auditors who need to understand controls relevant to financial reporting.

Question 4

During a SOC examination, the service auditor identifies a gap between how management describes a control and how it actually operates. How should this be communicated?

Accepted Answer

Include a qualified or adverse opinion in the auditor's report

Answer

A material discrepancy between the description and actual control operation would result in a qualified or adverse opinion communicated formally in the auditor's report.

Question 5

What is a 'bridge letter' in the context of SOC reporting stakeholder communications?

Accepted Answer

A written update from the service organization covering the period after the report's end date

Answer

A bridge letter (also called a gap letter) is issued by the service organization to update stakeholders on any material changes in controls after the SOC report period ends.

(SOC) System and Organization Controls Certification Practice Test

(SOC) System and Organization Controls Certification Practice Test

SOC Communication & Stakeholder Relations 2