Governance, Risk, Audit & Privacy · Foundational

System and Organization Controls Report (SOC report)

AICPA attestation report by a CPA on controls at a service organization.

Definition

SOC reports come in three main forms: SOC 1 (controls relevant to user entities' financial reporting), SOC 2 (controls relevant to the Trust Services Criteria), and SOC 3 (general-use summary of SOC 2). They are performed under SSAE 18 attestation standards and help customers assess vendor controls without auditing them directly.

Related terms