Addressing additional subject matter and criteria in SOC 2® engagement

A service organization may engage the service auditor to examine and report on subject matters in addition to the description of the service organization’s system in accordance with the description criteria and the suitability of design and operating effectiveness of controls based on the applicable trust services criteria. In that case, the service auditor would also examine and report on whether the additional subject matter is presented in accordance with the additional suitable criteria used to evaluate it. The following