System and organization controls

System and organization controls (SOC; also sometimes referred to as service organizations controls) as defined by the American Institute of Certified Public Accountants (AICPA), is the name of a suite of reports produced during an audit. It is intended for use by service organizations (organizations that provide information systems as a service to other organizations) to issue validated reports of internal controls over those information systems to the users of those services.

The reports focus on controls grouped into five categories called Trust Service Criteria. The Trust Services Criteria were established by the AICPA through its Assurance Services Executive Committee (ASEC) in 2017 (2017 TSC). These control criteria are to be used by the practitioner/examiner (Certified Public Accountant, CPA) in attestation or consulting engagements to evaluate and report on controls of information systems offered as a service. The engagements can be done on an entity wide, subsidiary, division, operating unit, product line or functional area basis.

The Trust Services Criteria were modeled in conformity to The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control – Integrated Framework (COSO Framework). In addition, the Trust Services Criteria can be mapped to NIST SP 800 – 53 criteria and to EU General Data Protection Regulation (GDPR) Articles. The AICPA auditing standard Statement on Standards for Attestation Engagements no. 18 (SSAE 18), section 320, "Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting", defines two levels of reporting, type 1 and type 2. Additional AICPA guidance materials specify three types of reporting: SOC 1, SOC 2, and SOC 3.

"AICPA Statement on Standards for Attestation Engagements No. 18". AICPA & CIMA. AICPA. pp. 231–233. Retrieved 16 November 2023.

↑ "SOC 2 – SOC for Service Organizations: Trust Services Criteria". AICPA. Retrieved 2025-12-29.

↑ "System and Organization Controls: SOC Suite of Services". AICPA. Retrieved 2025-12-29.