Review the subject matter expert's findings.

Back

CONTROL ID
16559

CONTROL TYPE
Audits and Risk Management

CLASSIFICATION
Detective

SUPPORTING AND SUPPORTED CONTROLS

This Control directly supports the implied Control(s):

Engage subject matter experts when the auditor requires additional expertise during an attestation engagement, as necessary., CC ID: 13971

There are no implementation support Controls.

SELECTED AUTHORITY DOCUMENTS COMPLIED WITH

Chapter 2 discusses the service auditor's responsibilities when a service auditor's specialist will be used in the SOC 2 examination. Those responsibilities include (a) evaluating the specialist's competence, capabilities, and objectivity; (b) obtaining an understanding of the specialist's field of … (¶ 3.209, SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
The significance of the service auditor's specialist's work in the context of the engagement (¶ 2.181 a., SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
Assumptions and methods used by the specialist and whether they are generally accepted within the specialist's field and appropriate in the engagement circumstances (¶ 2.180 c., SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
Obtaining an understanding of the work of the specialist (¶ 3.145 Bullet 2, SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
In addition to the matters discussed in this section, paragraph .37d of AT-C section 205 also indicates that the service auditor should evaluate the adequacy of the work of the service auditor's specialist for the service auditor's purposes. That evaluation is discussed further beginning in paragrap… (¶ 2.182, SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
The nature of internal and external data or information used by the service auditor's specialist (¶ 2.180 d., SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
If the work of the service auditor's specialist involves the use of source data that is significant to the work of the service auditor's specialist, the relevance, completeness, and accuracy of that source data (¶ 3.210 c., SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
The relevance and reasonableness of the findings and conclusions of the specialist and their consistency with other evidence (¶ 3.210 a., SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
obtaining an understanding of those assumptions and methods and (¶ 3.210 b.i., SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)
evaluating the relevance and reasonableness of those assumptions and methods in the circumstances, giving consideration to the rationale and support provided by the service auditor's specialist, and in relation to the service auditor's other findings and conclusions (¶ 3.210 b.ii., SOC 2Â® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, October 15, 2022)