Attestation
A formal opinion by a licensed CPA on management's assertion about a set of controls.
In the SOC 2 context, attestation means a licensed CPA firm has examined controls and issued an opinion. Unlike certification, attestation produces a report rather than a certificate, and it always ties to management's own assertion.
Understand the assertion and the scope
An attestation engagement evaluates a defined subject against specified criteria. In SOC 2, management describes its system and makes an assertion about relevant controls; the practitioner examines that assertion and reports an opinion. The scope, report period, and criteria explain what the opinion actually addresses.
Use the report in a decision
When a customer requests assurance, identify the service and control concerns behind the request. Share appropriate evidence under the relevant confidentiality arrangements and explain exceptions or customer responsibilities. A report that covers a different product or time period may not answer the customer’s actual question.
Do not equate every assurance label
Self-attestation, a CPA examination, and a third-party certification are not interchangeable. They differ in who performs the work, the criteria used, and the output. Record which type of evidence you hold and its limitations, rather than using certified as a catch-all description for an attestation report.
Related terms
See how Scarlet Risk covers Attestation.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo