SOC Professional Standards & Ethics 2 — Questions and Answers
Question 1: Under the AICPA Code of Professional Conduct, which principle requires a CPA to be straightforward and honest in professional and business relationships?
- Integrity (Correct answer)
- Objectivity
- Due care
- Confidentiality
Correct answer: Integrity
Integrity requires CPAs to be straightforward, honest, and not knowingly misrepresent facts in professional and business relationships.
Question 2: A SOC 2 service auditor discovers that management has omitted a material control from the system description. What is the auditor's most appropriate course of action?
- Issue a qualified or adverse opinion on the description (Correct answer)
- Withdraw from the engagement immediately
- Add the omitted control without informing management
- Disregard the omission if other controls compensate
Correct answer: Issue a qualified or adverse opinion on the description
When a material omission exists in the description, the auditor must modify the opinion to reflect that the description is not fairly presented.
Question 3: Which AICPA standard governs the performance of SOC 1 engagements?
- SSAE No. 18 (AT-C Section 320) (Correct answer)
- SAS No. 70
- PCAOB AS 2201
- ISA 402
Correct answer: SSAE No. 18 (AT-C Section 320)
SSAE No. 18, specifically AT-C Section 320, is the current AICPA standard that replaced SAS 70 and governs SOC 1 reporting on controls at a service organization.
Question 4: An auditor's ethical obligation of confidentiality in a SOC engagement is MOST likely overridden when:
- A court subpoena requires disclosure of workpapers (Correct answer)
- The client asks the auditor to share findings with investors
- A competitor requests the SOC report under FOIA
- The auditor changes firms mid-engagement
Correct answer: A court subpoena requires disclosure of workpapers
Legal obligations such as a court subpoena can override the confidentiality duty, as compliance with law supersedes professional confidentiality rules.
Question 5: The concept of 'professional skepticism' in SOC engagements means the auditor should:
- Maintain a questioning mind and critically assess audit evidence (Correct answer)
- Assume management is always dishonest
- Accept all representations without corroboration
- Limit testing to areas where fraud is suspected
Correct answer: Maintain a questioning mind and critically assess audit evidence
Professional skepticism involves a questioning mindset and critical evaluation of evidence rather than assuming honesty or dishonesty.
Question 6: When a service auditor becomes aware of a possible illegal act by the service organization during a SOC engagement, the auditor should FIRST:
- Obtain additional information and consult with legal counsel as appropriate (Correct answer)
- Immediately report the act to law enforcement
- Issue an adverse opinion and terminate the engagement
- Disclose the act in the SOC report without further investigation
Correct answer: Obtain additional information and consult with legal counsel as appropriate
The auditor should first gather more information and consult with legal counsel to understand the nature and implications before taking further action.
Question 7: Which of the following BEST describes the purpose of a management assertion in a SOC engagement?
- Management's written acknowledgment of responsibility for the fairness of the system description and control effectiveness (Correct answer)
- The auditor's conclusion about whether controls operated effectively
- A regulatory filing confirming compliance with SOC standards
- A user auditor's reliance statement on the service organization's controls
Correct answer: Management's written acknowledgment of responsibility for the fairness of the system description and control effectiveness
Management's assertion is a written statement taking responsibility for the description's fairness and the design and operating effectiveness of controls.
SOC Professional Standards & Ethics 2
Under the AICPA Code of Professional Conduct, which principle requires a CPA to be straightforward and honest in professional and business relationships?