ISC CPA Exam: How to Prepare Results of Testing of Controls to be Included in the SOC 2 Report of the Test of a Control

Introduction

Overview of SOC 2® Reporting

In this article, we’ll cover how to prepare results of testing of controls to be included in the SOC 2 report of the test of a Control. SOC 2® reports are essential tools used to provide assurance to stakeholders regarding the effectiveness of a service organization’s internal controls over key areas such as security, availability, processing integrity, confidentiality, and privacy. These reports are primarily targeted at organizations that provide cloud-based services, SaaS solutions, or handle sensitive client data. They demonstrate the organization’s commitment to maintaining rigorous control measures that meet the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria.

SOC 2® reports are highly valued by clients and partners, as they help build trust and accountability by providing independent validation of how a service organization safeguards its systems and data. In particular, these reports can support risk management, vendor evaluation, and compliance efforts, which are critical for organizations in industries where data protection and system integrity are paramount.

Purpose of Control Testing

Control testing is a core component of the SOC 2® audit process, designed to evaluate whether a service organization’s internal controls are appropriately designed and effectively implemented. Control testing assesses both the design and operating effectiveness of controls, ensuring they function as intended over a specified review period. The testing process involves a detailed examination of control procedures, with auditors selecting samples, reviewing documentation, and performing inquiries to validate the functionality of the controls in place.

The main goal of control testing is to verify that the controls supporting the organization’s operations and data management meet the required trust service principles. These controls ensure that the organization’s systems are not only properly secured and maintained but also operate with integrity and reliability, reducing the risk of security breaches, data mishandling, or system downtime.

Importance of Reporting Test Results

The test results documented in a SOC 2® report play a vital role in communicating the effectiveness of the organization’s internal controls to interested parties, such as customers, partners, and regulators. Detailed and accurate test results provide transparency into how well the controls are functioning and give stakeholders confidence in the organization’s ability to manage risks and protect data.

By documenting the testing methodology, the results of each control test, and any exceptions or deviations identified, auditors provide clear insights into the control environment. A well-prepared report with detailed test results allows stakeholders to make informed decisions about their relationship with the service organization, whether for risk management purposes or to ensure compliance with regulatory and contractual requirements. Furthermore, clear reporting of test results, particularly when exceptions are identified, offers an opportunity for organizations to address potential control gaps and take corrective action where necessary.

Control testing results are critical in demonstrating a service organization’s control effectiveness, building trust with clients and third parties, and fostering transparency regarding how risks are managed within the organization.

Understanding Control Testing in SOC 2®

Definition of Control Testing

Control testing in SOC 2® engagements is a crucial process that evaluates whether the controls implemented by a service organization are designed appropriately and are operating effectively over a specified period. This testing is essential for determining whether the organization meets the relevant Trust Services Criteria, which cover areas like security, availability, processing integrity, confidentiality, and privacy.

The testing involves two main aspects:

1. Design Effectiveness: This evaluates whether the control is designed in such a way that, if operating as intended, it would effectively mitigate risks and meet the intended control objectives. For example, a control designed to restrict access to sensitive data would be reviewed to ensure it appropriately limits access based on user roles.
2. Operating Effectiveness: This assesses whether the control operates consistently over time as designed. In this phase, the auditor tests how well the control has been functioning over a particular period, ensuring that it performs as expected in preventing or detecting risks. For instance, if a control requires quarterly access reviews, auditors will verify if those reviews occurred on schedule and were properly documented.

Together, these tests provide a comprehensive view of whether the controls in place can effectively protect the organization’s systems and data.

Types of Controls Tested

The controls tested in a SOC 2® engagement align with the five Trust Services Criteria (TSC), each addressing different aspects of a service organization’s operations and data handling processes. The types of controls typically tested include:

1. Security Controls: These controls safeguard the system against unauthorized access, whether intentional or accidental, ensuring that the organization’s data and systems are protected from breaches and vulnerabilities.
2. Availability Controls: These focus on the system’s operational uptime, ensuring that systems are accessible when needed. Availability controls are vital for organizations that rely on real-time data and service delivery.
3. Processing Integrity Controls: These ensure that the system processes data completely, accurately, and at the appropriate time, ensuring data integrity across transactions and processes.
4. Confidentiality Controls: These safeguard sensitive information from unauthorized access or disclosure. Controls here are focused on data encryption, access restrictions, and data retention policies.
5. Privacy Controls: These controls pertain to the organization’s handling of personal data, ensuring compliance with applicable privacy laws and regulations, such as GDPR or CCPA.

Each type of control focuses on minimizing risks in critical operational areas and ensuring the organization’s systems meet both internal and external requirements.

Methods for Testing Controls

Auditors use various methods to test the controls implemented by an organization. These methods help validate both the design and the operating effectiveness of the controls. Common control testing methods in SOC 2® engagements include:

1. Observation: This method involves the auditor directly observing processes or activities to ensure the control is functioning as intended. For instance, an auditor might watch an IT administrator perform a system backup to verify the process adheres to the established control policies.
2. Inspection: In this method, auditors review documentation, logs, policies, and procedures to verify the existence and execution of controls. For example, they may inspect access logs to confirm that only authorized individuals have accessed the system.
3. Inquiry: This involves interviewing employees and management to gather evidence on how controls are performed and whether they are understood by those responsible for executing them. While inquiry is useful, it is often combined with other methods to corroborate findings.
4. Re-performance: This method requires the auditor to re-perform a control to test whether it produces the expected results. For example, the auditor might attempt to recreate a user access request and approval process to see if it follows the established access control protocols.

These methods are often used in combination to gain a comprehensive understanding of how well the controls are designed and functioning. Depending on the control’s nature, the auditor may focus on a specific testing method or combine several methods to ensure thorough evaluation.

Preparing Results for SOC 2® Reports

Structuring Test Results

When preparing the results of control testing for inclusion in a SOC 2® report, it is essential to follow a clear and organized structure. This not only ensures that stakeholders can easily understand the findings, but it also provides the necessary transparency to assess the effectiveness of the tested controls. A well-structured result includes the control objective, a description of the control, the testing methodology, and the results of the test.

Control Objective

The first step in structuring test results is clearly identifying the control objective that was tested. The control objective is the intended purpose of the control, which aligns with one of the Trust Services Criteria (e.g., security, availability). For instance, a control objective might be “to ensure that only authorized users can access sensitive data within the system.” Clearly stating the control objective provides the context for understanding why the control is critical to the organization’s operations and data security.

Description of the Control

Next, provide a detailed description of the control being tested. This includes the specific control activities implemented by the service organization to achieve the control objective. The description should cover:

• The design: How the control was structured, including the processes, policies, or systems that support its operation.
• The purpose: What the control is intended to accomplish, such as preventing unauthorized access or ensuring data accuracy.

For example, if the control is an access management system, the description might include details about user authentication, role-based access controls, and periodic reviews of access rights.

Testing Methodology

The testing methodology outlines how the control was tested, including the techniques used and the testing scope. This section should provide enough detail to ensure that the reader understands the rigor of the testing process. Key elements to include are:

• Sampling techniques: For example, if user access logs were tested, explain whether a random sample of users was selected and how large the sample size was.
• Timeframes: Specify the period during which the control was tested. For instance, “The control was tested over a six-month period from January to June 2024.”
• Testing procedures: Outline the specific steps taken, such as inspecting logs, interviewing personnel, or re-performing a control.

By detailing the testing methodology, auditors provide transparency into how conclusions about the control’s effectiveness were reached.

Results of the Test

Finally, the results of the test should be presented in a clear and concise manner. This section should specify whether the control passed or failed based on the testing criteria and describe the outcomes. For example:

• Pass: “The control met the objective, with no exceptions noted. All user access requests during the sample period were appropriately approved and documented.”
• Fail: “The control failed to meet the objective. Two instances were identified where access was granted without the necessary approvals.”

When reporting test results, it is critical to identify the criteria used to determine success or failure, such as compliance with a policy or standard procedure.

Providing Evidence of Testing

To support the findings, evidence of testing should be included in the SOC 2® report. This evidence substantiates the conclusions drawn from the control testing and may include:

• Screenshots: Captures of system configurations or access logs showing the control in operation.
• Logs: User access logs, transaction logs, or other audit trails that demonstrate control activity.
• Audit trails: Documentation of key actions, such as access approvals, system changes, or backup operations.

Providing this evidence ensures that the testing process is well-documented and can be verified by external reviewers or stakeholders.

Clear and Objective Language

When documenting test results, it is important to use clear and objective language to ensure that the report is easily understood by all stakeholders, including those who may not be familiar with technical details. The following best practices can help:

• Be concise: Avoid unnecessary jargon or overly technical explanations. Stick to the facts and present the information in a straightforward manner.
• Stay neutral: The report should be written in a neutral tone, avoiding any subjective or biased statements. Instead of saying “the control is excellent,” state that “the control met the testing criteria.”
• Use precise wording: Clearly distinguish between facts and auditor opinions. If an exception is found, explain what occurred without exaggeration or ambiguity.

By adhering to these practices, the SOC 2® report will be more transparent, allowing stakeholders to assess the effectiveness of the controls based on the presented evidence and test results.

Handling Exceptions in the Test Results

Definition of an Exception

In the context of control testing, an exception occurs when a control fails to perform as expected or does not fully meet the predefined control objective. An exception indicates a deviation from the control’s intended design or operation, and it highlights areas where the control may not be effectively mitigating the associated risks. For example, an exception might occur if a system fails to prevent unauthorized access due to a misconfigured security setting or if periodic reviews of access permissions were not completed on time. Exceptions do not necessarily indicate a critical failure but point to weaknesses or irregularities that need further evaluation.

Impact of an Exception

The presence of an exception in control testing can have significant implications for the SOC 2® report and the organization’s overall compliance status. Depending on the nature and severity of the exception, it may:

• Lead to a qualified opinion: If the exception is material and affects the ability of the control to meet the relevant Trust Services Criteria, the SOC 2® report may include a qualified opinion. This signals to stakeholders that certain controls did not operate effectively.
• Affect stakeholder confidence: Exceptions, particularly those involving security or confidentiality controls, can raise concerns among clients, partners, and regulators. Stakeholders may view exceptions as indicators of potential vulnerabilities or risks to data integrity and system reliability.
• Require remediation: In many cases, organizations will need to address exceptions through corrective actions or remediation plans. This could involve revising control processes, enhancing oversight, or implementing additional controls to mitigate the identified risks.

While exceptions can affect the overall assessment of control effectiveness, proper documentation and transparency in reporting these findings are crucial in demonstrating that the organization is committed to resolving any control weaknesses.

Documenting Exceptions

When documenting exceptions in a SOC 2® report, it is essential to provide detailed and accurate information to ensure clarity and transparency. Proper documentation helps stakeholders understand the nature of the exception, its implications, and the steps taken to address it.

Details of the Exception

The details of the exception should be described with precision, including:

• Nature of the exception: What exactly went wrong? For example, was it a failure to follow a specific control procedure, or did a technical issue prevent the control from functioning as intended?
• Cause of the exception: Identify the underlying reason for the failure, whether it was due to human error, system malfunction, or a gap in the control design.
• Timing of the exception: Specify when the exception occurred, whether it was a one-time incident or a recurring issue. For instance, if an access review wasn’t performed on schedule, indicate the time period during which this oversight happened.

By documenting these key details, auditors can help stakeholders understand the exception’s context and potential impact on the control environment.

Extent and Severity of the Exception

The extent and severity of the exception should also be carefully evaluated and reported. This involves:

• Scope of the exception: Was it an isolated incident, or did it affect multiple systems or processes? For example, an exception might affect just one access control review or represent a larger issue impacting multiple departments.
• Materiality: Assess whether the exception materially affects the control’s ability to meet the relevant Trust Services Criteria. Material exceptions are those that significantly impact the effectiveness of the control, whereas minor exceptions might have little to no impact on overall control objectives.

Understanding the scope and materiality of the exception helps determine how it should be addressed in the SOC 2® report and whether it requires immediate remediation.

Testing After the Exception

When an exception is identified, additional testing after the exception may be necessary to assess whether the issue was isolated or indicative of a broader problem. This often involves:

• Retesting the control: After addressing the root cause of the exception, auditors may perform retesting to determine whether the control is now functioning correctly. This helps ensure that the issue has been resolved and that the control can be relied upon going forward.
• Expanding the testing scope: In cases where an exception raises concerns about systemic issues, auditors may expand the scope of testing to include additional samples, time periods, or related controls. This allows for a more comprehensive assessment of the control environment.

By conducting additional testing, auditors can provide assurance that the exception has been properly addressed or highlight areas that still require further attention.

Properly documenting and addressing exceptions not only enhances the quality and transparency of the SOC 2® report but also demonstrates the organization’s commitment to maintaining an effective and reliable control environment.

Reporting Exceptions in the SOC 2® Report

How to Include Exceptions in the Report

When exceptions are identified during control testing, it is critical to document them accurately and transparently in the SOC 2® report. The way exceptions are reported can influence how stakeholders perceive the organization’s control environment and compliance with the Trust Services Criteria. Proper reporting of exceptions ensures that the report provides a clear picture of control effectiveness and any areas of concern.

Clear Reporting of the Exception in the Relevant Section of the SOC 2® Report

Exceptions should be reported in the appropriate sections of the SOC 2® report, typically under the results of control testing or findings. It is important to provide a concise but thorough description of the exception, detailing:

• What the exception was: Clearly explain the nature of the control failure or deviation from expected performance.
• Where the exception occurred: Indicate the specific control or system where the exception was found.
• When the exception took place: Provide details on the timing of the exception, including whether it was a one-time incident or part of a recurring issue.
• Why the exception happened: Offer insights into the root cause of the exception, whether due to a process gap, human error, or system failure.

By presenting this information clearly, the SOC 2® report ensures that stakeholders have the context needed to understand the significance of the exception and its potential impact on the overall control environment.

Distinguishing Between a “Qualified” and “Unqualified” Report When Exceptions Are Present

The presence of exceptions can affect the type of opinion rendered in the SOC 2® report. The report may be either “unqualified” or “qualified,” depending on the severity and materiality of the exceptions:

• Unqualified Report: An unqualified report is issued when the exceptions identified are not material enough to affect the overall effectiveness of the controls. In this case, the report concludes that the organization’s controls meet the Trust Services Criteria despite the exceptions. Minor or isolated exceptions that do not represent systemic failures typically fall into this category.
• Qualified Report: A qualified report is issued when the exceptions are significant or material, potentially impacting the organization’s ability to meet one or more Trust Services Criteria. In a qualified report, the auditor highlights the areas where the controls did not function effectively, which may affect stakeholder confidence and require immediate remediation.

It is crucial to distinguish between these two types of reports, as they convey different levels of assurance about the organization’s control environment.

Management Response to Exceptions

In the SOC 2® report, it is important to document management’s response to any exceptions identified during control testing. Management’s response typically outlines how they plan to address or have already addressed the identified control weaknesses. This section helps demonstrate that the organization is actively managing its control environment and is committed to resolving any issues.

The management response section should include:

• Acknowledgment of the exception: Management should acknowledge the exception and confirm their understanding of the issue.
• Immediate actions taken: If management has already implemented corrective actions, these should be detailed, such as revising a control process, updating a policy, or implementing additional training.
• Future remediation efforts: If the exception has not yet been fully resolved, management should provide a timeline and plan for addressing the issue, including any monitoring efforts to ensure continued effectiveness.

Including a well-documented management response demonstrates the organization’s proactive approach to mitigating risks and improving control effectiveness.

Potential Remediation Plans

When an exception is identified, remediation plans outline the steps management intends to take to resolve the control weakness. Remediation plans are essential for improving the control environment and preventing future exceptions from occurring.

A remediation plan should include:

• Specific corrective actions: Detail the specific steps management will take to address the root cause of the exception. For example, if the exception involved a failure to review user access permissions, management might implement more frequent access reviews and automate the process.
• Timeline for implementation: The plan should include a clear timeline for when corrective actions will be completed. This could range from immediate fixes to longer-term solutions that require system updates or policy changes.
• Monitoring and testing of remediation efforts: Management should describe how they will monitor the effectiveness of the remediation plan. This may include periodic retesting of the control or implementing ongoing oversight to ensure the control operates as intended.

The remediation plan should be presented in the SOC 2® report to provide transparency into how the organization will correct identified issues and strengthen its control environment moving forward. Including this information demonstrates accountability and a commitment to continuous improvement, which can help restore stakeholder confidence after exceptions are found.

Ensuring Accuracy and Completeness

Review and Verification Process

The accuracy and completeness of a SOC 2® report are critical to its reliability and the trust that stakeholders place in it. The review and verification process is essential to ensuring that all aspects of the control testing and any exceptions identified are accurately reflected in the report. Auditors must perform a detailed review of their findings to ensure that nothing is omitted, misrepresented, or inaccurately stated.

• Cross-check findings: The results of the control tests should be cross-checked with supporting documentation, such as logs, access records, or other audit evidence, to confirm that the findings are correctly captured.
• Validation of exceptions: Exceptions identified during the testing phase must be carefully documented, with clear explanations of the nature, cause, and potential impact of the control failure. Auditors should verify that these exceptions are fully explained in the report and that the information is consistent with the evidence gathered.
• Review of remediation efforts: If management has taken corrective actions to address any exceptions, the remediation efforts should be validated by retesting the controls or reviewing documentation that demonstrates the corrective measures have been implemented and are effective.

This review process helps to maintain the integrity of the report, ensuring that it provides a transparent and accurate assessment of the service organization’s control environment. Accuracy is critical for avoiding miscommunication with stakeholders, as errors or omissions can lead to incorrect conclusions about the effectiveness of the controls.

Coordination with the Service Organization

Effective coordination between auditors and the service organization’s management is crucial to the accuracy and completeness of the SOC 2® report. Engaging with the service organization throughout the audit process ensures that all relevant information is captured, and it helps to avoid misunderstandings about the controls being tested and any exceptions identified.

• Clear communication channels: Establishing clear lines of communication with the service organization’s management is essential for addressing any questions or concerns that arise during the audit. Regular meetings or status updates can ensure that both parties are aligned on the audit’s progress and findings.
• Access to relevant documentation: The service organization must provide complete and accurate documentation related to the controls being tested. This includes logs, access records, policies, and any additional evidence required to verify control effectiveness. Auditors should work closely with management to ensure that all relevant documents are made available in a timely manner.
• Confirmation of management’s response: When exceptions are identified, auditors should collaborate with the service organization’s management to confirm that their response is accurately documented in the report. This includes verifying any corrective actions or remediation plans that have been implemented or are planned for the future.
• Joint review of the report: Before the report is finalized, it is good practice to review the findings and conclusions with the service organization’s management. This ensures that there is a shared understanding of the results, and it gives management the opportunity to provide feedback or clarification on the controls and exceptions described in the report.

By fostering collaboration and open communication with the service organization, auditors can ensure that all relevant details are captured, and that the final SOC 2® report provides a complete and accurate representation of the organization’s control environment. This coordination strengthens the report’s credibility and fosters transparency for all stakeholders involved.

Best Practices for Presenting Test Results in SOC 2® Reports

Consistency in Reporting

Maintaining consistency in reporting is essential for creating a clear and professional SOC 2® report. Consistency ensures that all test results are presented in a standardized format, making it easier for readers to understand and evaluate the findings. Here are key practices to follow:

• Uniform format: Use the same format when reporting the results for each control tested. This includes structuring each section with a control objective, a description of the control, the testing methodology, and the results.
• Standardized language: Apply consistent terminology and phrasing throughout the report. For example, use the same wording to describe test procedures (e.g., “inspected,” “inquired,” “observed”) and outcomes (e.g., “pass,” “fail,” “exception noted”).
• Presentation of data: If the report includes data, such as test samples or statistical results, ensure that they are consistently formatted with appropriate tables, charts, or bullet points to enhance readability. Avoid unnecessary variations in how information is presented.

Consistency across the report creates a professional appearance and ensures that readers can quickly grasp the findings without needing to adjust to different reporting styles.

Maintaining Transparency and Objectivity

In a SOC 2® report, transparency and objectivity are critical for maintaining trustworthiness. The report must present test results and exceptions in a clear, unbiased manner, ensuring that stakeholders can trust the information provided.

• Objective language: Avoid subjective or overly positive language. Instead of stating that “controls performed excellently,” simply report that “controls met the testing criteria” or “operated effectively.” Likewise, when describing exceptions, avoid downplaying their significance. Be factual and straightforward in describing what occurred.
• Full disclosure of findings: Transparency requires that all relevant test results—both positive and negative—be fully disclosed. If an exception was found, it should be clearly reported along with the supporting evidence and any steps taken to address it. Omitting negative results can harm the credibility of the report and lead to reputational damage.
• Clear identification of exceptions: Ensure that any exceptions are clearly distinguished from other findings. Use distinct headings or sections to call attention to areas where controls did not perform as expected, and provide an objective analysis of their impact.

Maintaining an objective and transparent tone in the SOC 2® report strengthens its credibility and reassures stakeholders that the findings are trustworthy and free from bias.

Addressing the Audience

It is important to tailor the language and presentation of test results to the intended audience of the SOC 2® report. Since the report is often used by various stakeholders, including auditors, management, and third parties (such as customers or regulators), the presentation of information should consider their different needs and levels of expertise.

• Auditors: Auditors reviewing the report may be looking for detailed technical information on control effectiveness and testing methodologies. Ensure that technical terms are used appropriately and that evidence is presented in a manner that supports audit conclusions.
• Management: For management, the report should highlight any areas where improvements are needed and provide clear documentation of any exceptions. Management will be particularly interested in the remediation plans and how exceptions will be addressed going forward. Ensure that action steps and timelines are clearly presented.
• Third parties: External stakeholders, such as clients or regulatory bodies, may not have a deep technical understanding of the controls but will rely on the report for assurance about the organization’s security and operational reliability. For this audience, it is important to present findings in straightforward, non-technical language. Summaries of key results and conclusions should be provided at the beginning of the report to give them a quick overview of the most critical findings.

By tailoring the content to the report’s audience, auditors can ensure that the SOC 2® report is accessible, informative, and relevant to all stakeholders involved. This approach enhances the utility of the report and helps build trust across the board.

Conclusion

Summary of Key Points

In preparing control test results for SOC 2® reports, it is essential to follow a structured approach that ensures all relevant details are clearly documented and accurately presented. The process begins with identifying the control objective, describing the control, detailing the testing methodology, and providing clear results. When exceptions are identified, they must be fully documented, including the nature, cause, timing, and severity of the exception. Remediation efforts and management responses should also be clearly outlined to demonstrate how any weaknesses will be addressed. Additionally, ensuring accuracy and consistency throughout the report is key, as well as coordinating with the service organization to capture all relevant information.

Importance of Accurate Reporting

Accurate, transparent, and objective reporting is the foundation of a reliable SOC 2® report. This ensures that stakeholders—whether they are auditors, management, or external third parties—can trust the findings and make informed decisions based on the information provided. Clear and consistent presentation of test results, including any exceptions and remediation efforts, fosters confidence in the service organization’s commitment to maintaining strong internal controls. Inaccurate or incomplete reporting could lead to misunderstandings, erode stakeholder trust, and potentially expose the organization to greater risk.

Final Thoughts on Control Testing

Control testing is a critical aspect of SOC 2® audits, and the thorough preparation of test results contributes to the overall assurance that the report provides. By documenting the effectiveness of the organization’s internal controls and addressing any exceptions transparently, the SOC 2® report serves as a valuable tool for demonstrating compliance with the Trust Services Criteria. In addition to providing assurance to stakeholders, the process of testing and reporting on controls also allows organizations to identify areas for improvement and strengthen their control environment over time. Ultimately, clear and detailed reporting supports an organization’s long-term success by building trust, enhancing compliance, and mitigating operational risks.