SOC Professional Standards & Ethics 3 — Questions and Answers
Question 1: Under AT-C Section 105, which of the following is a required element of an attest engagement?
- A written assertion by the responsible party about the subject matter (Correct answer)
- An oral representation from management
- A peer review of the attestation report
- A regulatory filing with the SEC
Correct answer: A written assertion by the responsible party about the subject matter
AT-C Section 105 requires a written assertion from the responsible party as a fundamental element of an attestation engagement.
Question 2: A service auditor's independence is MOST likely impaired if the auditor:
- Performs bookkeeping services for the service organization being examined (Correct answer)
- Reviews the service organization's security policies without recording transactions
- Interviews service organization employees about control procedures
- Travels to the service organization's premises to observe controls
Correct answer: Performs bookkeeping services for the service organization being examined
Performing bookkeeping or accounting services for an attest client creates a self-review threat that impairs independence.
Question 3: The AICPA's 'Conceptual Framework for Independence' identifies which approach to evaluating independence threats?
- Identify threats, evaluate their significance, and apply safeguards (Correct answer)
- Apply a bright-line rule for every situation
- Consult the SEC for guidance on every threat
- Rely solely on management's representations about independence
Correct answer: Identify threats, evaluate their significance, and apply safeguards
The conceptual framework uses a threats-and-safeguards approach: identify the threat, assess its significance, and apply appropriate safeguards.
Question 4: Which type of SOC report is restricted to specified parties (management, user entities, and user auditors)?
- SOC 1 Type II report (Correct answer)
- SOC 2 Type II report made publicly available
- SOC 3 report
- SSAE 18 general-use report
Correct answer: SOC 1 Type II report
SOC 1 reports are restricted-use documents intended only for management of the service organization, user entities, and their auditors.
Question 5: An ethical 'cooling-off period' is relevant in SOC engagements because it:
- Prevents a former employee of the service organization from immediately serving as the service auditor (Correct answer)
- Requires the auditor to wait before issuing a report after fieldwork
- Mandates a gap between two consecutive SOC engagement periods
- Limits how quickly management can respond to auditor findings
Correct answer: Prevents a former employee of the service organization from immediately serving as the service auditor
A cooling-off period addresses familiarity and self-interest threats by requiring time before a former employee can audit their previous employer.
Question 6: When a SOC report contains a qualified opinion due to a control deficiency, which section of the report is MOST affected?
- The service auditor's opinion paragraph (Correct answer)
- The system description prepared by management
- The list of complementary user entity controls
- The criteria section referencing the Trust Services Criteria
Correct answer: The service auditor's opinion paragraph
A qualified opinion is expressed in the auditor's opinion paragraph, which is modified to reflect the exception found during the engagement.
Question 7: Which of the following actions by a SOC auditor BEST demonstrates adherence to the 'due professional care' standard?
- Thoroughly documenting all testing procedures and conclusions in workpapers (Correct answer)
- Completing the engagement as quickly as possible to reduce client costs
- Deferring all judgment calls to management to avoid bias
- Limiting the scope of testing to only high-risk controls
Correct answer: Thoroughly documenting all testing procedures and conclusions in workpapers
Thorough documentation of procedures and conclusions demonstrates the care and diligence expected of a competent professional.
SOC Professional Standards & Ethics 3
Under AT-C Section 105, which of the following is a required element of an attest engagement?