Management's assertion: the part of a SOC 2 report that is yours

A SOC 2 report is not one document. It is the service auditor's opinion, the description of the system, and a short written statement from the company's own management that sits alongside them. In our view that statement is the part people understand least and spend the least time on.

The service auditor's report gets the attention. The assertion is the part that belongs to the company.

Whose statement it is

The AICPA's attestation standards build the engagement around a "responsible party", which AT-C section 105 defines as "the party responsible for the underlying subject matter, which is a party other than the practitioner." In a SOC 2, that is the service organization: the 2011 Journal of Accountancy article on service organization controls reporting by Chris Halterman, CPA, says "management of the service organization has certain other responsibilities in a SOC 2 engagement," and lists among them "providing a written assertion to be attached to the description of the system."

So the answer to "who signs it" is the service organization's management, not the auditor. AT-C section 205, the standard for assertion-based examinations, says "the practitioner should request from the responsible party a written assertion about the measurement or evaluation of the underlying subject matter against the criteria."

In our view the cleanest way to hold the two apart is this: an assertion is a claim, and an examination is work done on a claim. Our reading of that arrangement is simple: the engagement runs on what management is willing to put in writing, so the care taken over your own words is not a formality to be handled at the end of the project.

What the statement says

What goes into the statement was set out in that Journal of Accountancy article, written before the AICPA's current SOC 2 criteria were issued:

"This written assertion by management confirms, to the best of management's knowledge and belief, that the description is fairly stated, controls were suitably designed to meet the applicable Trust Services criteria, and, for type 2 reports, the controls were operating effectively throughout the period."

Your auditor will give you the current wording. Each of those commitments costs something different to make good:

• The description is fairly stated. What the service does, where its boundary runs, which products are inside it, which providers sit behind it.
• The controls were suitably designed against the criteria the engagement covers. Which criteria those are is a scoping decision, and what a trust services criterion is covers how they work.
• For a type 2, the controls were operating effectively across the period. That is the line that separates the two report types, which is the subject of SOC 2 Type 1 versus Type 2.

Read in that order, the report stops being a single opinion and reads as what it is: a statement, a description, and independent work on both.

Why the standard insists on it

The assertion is not decoration. AT-C section 205 says that when the party that engaged the auditor is also the responsible party and "refuses to provide a written assertion," the practitioner is required "to withdraw from the engagement when withdrawal is possible under applicable law or regulation." No assertion, no examination.

The same standard also asks for a second document that is easy to confuse with the first. The practitioner "should request from the responsible party written representations in the form of a letter addressed to the practitioner." That letter includes the responsible party's assertion, acknowledges responsibility "for the subject matter and the responsible party's assertion," and states that management has disclosed matters such as "all deficiencies in internal control relevant to the engagement of which the responsible party is aware." The assertion in the report is what readers see. The representation letter is addressed to the auditor.

A claim is only as good as the record behind it

The assertion is short. The work that makes it true is not.

AT-C section 205 adds that the practitioner "should use professional judgment in determining whether management has a reasonable basis for making its assertion." In our view the transferable idea is the one that costs money when it is learned late: a signed conclusion about your own controls is worth what the record behind it is worth, and the question "what would we put in front of someone who asked" should have an answer before the page goes out rather than after.

Where a piece of the environment cannot be stood behind, the honest move is to narrow what the description claims, not to widen the claim and hope the soft spot stays quiet. A smaller boundary reads cleanly. A hedge does not.

What the assertion does not do

It does not move the claim onto the auditor. The opinion is independent precisely because the claim is yours.

It also does not finish the work for the customer reading it. SEC staff addressed that at Question 14 of its frequently asked questions on management's report on internal control over financial reporting, in a question framed around a registrant that "relies on a third party service provider to perform certain functions." The answer opens:

"In situations where management has outsourced certain functions to third party service provider(s), management maintains a responsibility to assess the controls over the outsourced operations."

And adds:

"Note, however, that management is still responsible for maintaining and evaluating, as appropriate, controls over the flow of information to and from the service organization."

That is staff guidance about a registrant's own assessment of internal control over financial reporting, so what reaches a given customer is a question for their auditor or counsel. The direction of travel is the useful part: your assertion is evidence in somebody else's process, not a substitute for it.

Banking regulators describe the same process from the buyer's side. The 2023 interagency guidance on third-party relationships says that "when relevant and available, a banking organization may consider reviewing System and Organization Control (SOC) reports and any conformity assessment or certification by independent third parties related to relevant domestic or international standards." That sentence is permissive and is addressed to banking organizations, so whether it reaches your customers is a question for their counsel.

Reading somebody else's assertion

The habit worth building, whether you are the vendor or the buyer, is to read the assertion before the opinion.

1. Check the period against the opinion. The dates in the assertion and the dates the opinion covers should be the same dates.
2. Find the product you actually use. A described boundary that does not name the service you bought is the finding, not a formality.
3. Look at who sits behind the provider. Infrastructure, payments and support vendors are either inside the described system or outside it, and which one changes what the report tells you.
4. Read the complementary user entity controls. Those are the lines the provider has placed on your side of the boundary, and complementary user entity controls covers what happens when nobody owns them.
5. Notice whose name is on it. A named officer reads differently from a title with nobody attached to it.

Before your own goes out

• Read the description against reality, line by line, with the person who operates each thing it describes in the room.
• Cut anything you cannot evidence rather than softening the words around it.
• Confirm the period you are asserting over is a period you were actually collecting evidence across.
• Make sure the controls you pushed onto customers are ones a customer can perform in the tier they bought.
• Keep the record where it can be found later, because the only version of this work that will exist a year from now is the one somebody can still put their hands on.

Where to start

Open your most recent report, or your draft, and read the assertion as a stranger would. If a sentence in it would need a conversation to defend, that sentence is the work.

If a customer date is driving the schedule, the SOC 2 timeline calculator maps the work back from it, and the readiness scorecard gives you an ordered list of what to close first.

This is general information, not audit or legal advice. Confirm what applies to you with your auditor or counsel.

Common questions

What is a management assertion in a SOC 2 report?

It is a written statement by the service organization's own management about its system. The AICPA's standard for assertion-based examinations, AT-C section 205, says the practitioner should request a written assertion from the responsible party. A 2011 Journal of Accountancy article on service organization controls reporting described the written assertion by management as confirming, to the best of management's knowledge and belief, that the description is fairly stated, that controls were suitably designed to meet the applicable Trust Services criteria, and, for type 2 reports, that the controls were operating effectively throughout the period.

Whose name should be on it?

In our view it should be someone who can be asked about any line of the system description and answer without opening a laptop. A name chosen because that person happened to be free that week is a weak point a careful reviewer can find, because the assertion is the part of the report the company itself is answering for.

Does a clean opinion mean our customers have nothing left to do?

In the financial reporting context, SEC staff has said that where management has outsourced certain functions, management maintains a responsibility to assess the controls over the outsourced operations, and remains responsible for maintaining and evaluating, as appropriate, controls over the flow of information to and from the service organization. That guidance is about a registrant's own assessment, so confirm what applies to your customers with their auditor or counsel.

What should we check when we read a vendor's assertion?

Read it before the opinion, and check that the period it names matches the period the opinion covers, that the products and systems you actually buy are inside the described boundary, and that the providers sitting behind your provider are treated in a way you can live with. Then read the complementary user entity controls, because those are the lines that come back to you.

What happens if part of our environment is not ready?

In our view the answer is to narrow the description rather than stretch the assertion over a gap. An assertion is a claim about a described system, so a smaller honest boundary is a better outcome than a wide boundary with a soft spot in it, and buyers can read a boundary far more easily than they can read a hedge.

Sources

1. U.S. Attestation Standards—AICPA (Clarified) [AT-C], including AT-C Section 105, Concepts Common to All Attestation Engagements, and AT-C Section 205, Assertion-Based Examination Engagements · Association of International Certified Professional Accountants (AICPA & CIMA)
2. Expanding Service Organization Controls Reporting, by Chris Halterman, CPA (July 1, 2011) · Journal of Accountancy, published by the AICPA
3. Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports — Frequently Asked Questions, Question 14 · U.S. Securities and Exchange Commission, Office of the Chief Accountant and Division of Corporation Finance
4. Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 · Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency, via the U.S. Government Publishing Office