Illustrative SOC 2® Report with Illustrative System Description

This illustrative example of a SOC 2 Type 2 report includes management’s assertion, the description of the system, the service auditor’s report and tests of controls and results thereof. The disclosures in the illustrative description of the system align with the requirements of DC 200. However, DC 200 is not specific about the format for a SOC 2 description. Service organizations may organize and present the required information in a variety of formats. The format of the illustrative disclosures presented