Citation Tagging

Citation Reference: ¶ 2.70 Bullet 4

Citation Guidance: Are the principal service commitments and system requirements complete? For example, in a SOC 2 examination that includes processing integrity, the service auditor would expect principal service commitments and system requirements to be identified related to completeness, validity, accuracy, timeliness, and authorization. An examination based on a complete set of principal service commitments and system requirements can provide intended users with the information they need to assess the effect of the service organization's controls on the risks associated with doing business with the service organization. However, the service auditor ordinarily will not be able to determine how the service organization's controls specifically address the risks specific to an individual intended user; accordingly, the service auditor need not consider completeness from the perspective of individual intended users. Instead, individual intended users are expected to assess whether the principal service commitments and system requirements disclosed in the description include those that are relevant to them.