Question 5 — D

System and organization controls (SOC) reports provide assurance about a service organization’s internal controls. SOC 1 reports provide assurance about a service organization’s controls relevant to the user entity’s financial reporting. SOC 2 reports, in contrast, provide assurance on the service organization’s controls over security, availability, processing integrity, confidentiality, and privacy of the user entity’s data. Generally, these reports are provided by the service organization to its clients. The emphasis of SOC 2 reports is on the operational fitness of IT systems. These reports can play an important role in: Oversight of the organization Vendor management programs Internal corporate governance and risk management processes Regulatory oversight Both SOC 1 and SOC 2 reports come in two types: Type 1 reports address only the accuracy of management’s description of the controls and whether those controls are suitably designed.Type 2 reports provide assurance about whether the controls are operating effectively.