SOC 2 Criteria Selection, System Boundaries, and Opinion Formation

Trust services criteria, system boundaries, testing, deviations, and opinion formation.

This chapter covers SOC 2 examinations and the trust services framework used to evaluate broader system controls. ISC emphasizes how criteria selection, system boundaries, testing, and deviations affect the final report conclusion.

SOC 2 questions should be scoped before they are answered. The selected trust services criteria, system description, and boundary determine what controls are relevant and how exceptions affect the report.

In This Chapter

Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) explains the control objectives available in SOC 2.
SOC 2® Description Criteria and System Boundaries covers how the described system is defined for reporting purposes.
Risk Assessment and Testing Controls for SOC 2® explains how the engagement moves from scope to evidence.
Evaluating Deviations, Exceptions, and Forming the Opinion focuses on how testing results shape the final conclusion.

SOC 2 Scope Lens

SOC 2 issue	What to decide first	Common ISC trap
Trust services criteria	Which criteria are included in the engagement scope.	Assuming security, availability, processing integrity, confidentiality, and privacy are always all included.
Description criteria and boundaries	What system, services, components, and users are covered by the description.	Evaluating controls outside the described system boundary.
Risk assessment and testing	Which controls address the scoped risks and criteria.	Testing controls without linking them to criteria and risks.
Deviations and opinion formation	Whether exceptions are isolated, pervasive, or severe enough to affect the report.	Treating every deviation as the same report consequence.

SOC 2 Examination Sequence

Step	ISC question to ask	Reporting effect
1. Select trust services criteria	Which criteria are included, and which are outside scope?	Scope determines which controls and risks matter.
2. Define the system boundary	What infrastructure, software, people, procedures, data, and users are described?	Controls outside the boundary should not drive the report conclusion.
3. Map risks to controls	Which controls address the scoped criteria and service commitments?	Testing should connect directly to risk and criteria.
4. Evaluate deviations	Are exceptions isolated, repeated, severe, or pervasive?	Deviation significance determines whether wording or opinion changes.
5. Form the conclusion	Does the evidence support the assertion, description, controls, and report opinion?	SOC 2 reporting must align scope, evidence, exceptions, and conclusion.

SOC 2 Evaluation Checkpoints

Checkpoint	Ask before evaluating evidence	Reporting consequence
Criteria included	Which trust services criteria are actually in scope?	Controls outside the selected criteria should not drive the conclusion.
Boundary clarity	Which infrastructure, software, people, procedures, data, and user responsibilities are described?	Misreading the system boundary can make relevant evidence look irrelevant, or the reverse.
Control-to-risk link	Which service commitment, system requirement, or risk does each tested control address?	Testing should support the scoped criteria, not a generic control inventory.
Exception pattern	Are deviations isolated, systemic, severe, or tied to a missing control?	The report effect depends on significance, not just the count of exceptions.
Opinion alignment	Does the final conclusion align with scope, management assertion, description, evidence, and deviations?	SOC 2 answers fail when the opinion wording does not match the engagement facts.

How to Use This Chapter

Read this chapter when SOC reporting is being evaluated beyond financial-reporting relevance alone.
Focus on which trust services criteria apply and how the system boundary affects the report.
Return here whenever an ISC question asks how exceptions influence a SOC 2 conclusion.

In this section

Trust Services Criteria and How SOC 2 Engagements Select Them
Trust services criteria and how SOC 2 engagements select them.
SOC 2 Description Criteria, System Boundaries, and Scope Definition
SOC 2 description criteria, system boundaries, and scope definition.
Risk Assessment, Control Testing, and Evidence Design in SOC 2
Risk assessment, control testing, and evidence design in SOC 2.
Evaluating Exceptions and Forming the Final SOC 2 Opinion
Evaluating exceptions and forming the final SOC 2 opinion.

Revised on Monday, June 15, 2026

23. SOC 1 Examinations

25. Planning & Performing a SOC Engagement

Browse Information Systems and Controls (ISC)