You are an expert agent performing AICPA SOC reporting work. Follow every instruction below precisely. Use AICPA terminology exclusively.

AICPA SOC Reporting Skill (Router)

This SKILL.md is a router. The deep-dive content lives in chunks/. Load the chunks that match the user's intent. See Section 11 Routing for the table.

1. When to Use / Not Use This Skill

Use This Skill When:

• User asks about SOC 1, SOC 2, SOC 3, SOC for Cybersecurity, or SOC for Supply Chain engagements.
• User needs to scope, draft, review, or validate a SOC report or any component therein.
• User inquires about trust services criteria (TSC), TSP Section 100, or specific criteria codes (CC*, A*, PI*, C*, P*).
• User requests management assertion letters, bridge letters, CUECs, or CSOCs.
• User asks about AT-C 105/205/320 (or the 100/200/300 series shorthand), SSAE 18/21, or AICPA attestation standards.
• User needs to determine which SOC type applies to a given scenario.
• User requires cross-framework mapping (COSO, ISO 27001, NIST 800-53, GDPR) for SOC criteria.
• User asks about service auditor opinion types, exception evaluation, or sampling guidance for Type II.
• User needs engagement lifecycle planning (scoping, evidence gathering, report issuance, monitoring).
• User asks about customer security questionnaires (CAIQ, SIG Lite, VSAQ), questionnaire reuse, or customer audit fatigue.
• User needs an audit committee / board-ready deck template (see assets/board_deck_template.md).

Do NOT Use This Skill When:

• User asks about financial statement audits (GAAS/PCAOB territory, not SOC attestation).
• User needs ISO 27001 certification guidance alone (without SOC overlap).
• User is performing a SOX ICFR audit (PCAOB AS 2201, not AICPA SOC 1).
• User asks about ISAE 3000/3402 exclusively (international standard -- unless comparing to AICPA SOC).
• User needs penetration testing or vulnerability assessment alone (not an attestation engagement).
• User asks about internal audit methodology unrelated to service organization controls.

2. Framework Overview

The AICPA SOC suite provides independent examination of a service organization's controls relevant to user entities' needs.

Governing standards: [AT-C-105] (concepts common to all attestation engagements), [AT-C-205] (assertion-based examinations — SOC 2/3), [AT-C-320] (SOC 1). SSAE 18 (Attestation Standards: Clarification and Recodification) remains the AT-C codification, AS AMENDED by SSAE 19-22; SSAE 21 added AT-C 206 (direct examinations) and renamed AT-C 205, effective for reports dated on or after June 15, 2022 — it did NOT supersede SSAE 18. Cite AT-C 105 + 205 for SOC 2/3 and AT-C 320 for SOC 1 when drafting report language.

2.1 Related professional standards (cross-jurisdictional context)

• [ISAE-3000-3402] — IAASB's international equivalents to the AICPA's AT-C standards; used for non-US jurisdictions where the ISAs apply (EU, UK, Canada, Australia, etc.). A SOC 1 issued under ISAE 3402 is functionally equivalent for most purposes. ISAE 3000 governs non-US assurance engagements broadly, including SOC 2 equivalents.
• [GDPR] — EU General Data Protection Regulation; relevant when the SOC 2 report includes the Privacy TSC category and the service organization processes EU personal data. The Privacy TSC maps to many GDPR articles, but GDPR-specific obligations (DPO appointment, DPIA, breach notification within 72h) are not in TSC and require separate compliance.

3. Core Concepts

3.1 SOC Report Types

• SOC 1 -- ICFR controls. Control objectives are management-defined (not standardized). See chunks/04-report-structures.md.
• SOC 2 -- TSC-based. Security (CC) always required; A, PI, C, P optional. 61 criteria total (33 CC + 28 category-specific), supported by ~200 points of focus (2022 revision).
• SOC 3 -- Same TSC as SOC 2, but abridged. No CUECs/CSOCs. General-use. No detailed tests of controls.
• SOC for Cybersecurity -- Entity-level cybersecurity program. Uses TSC (Security + Availability + Confidentiality). General-use.
• SOC for Supply Chain -- Production/manufacturing/distribution systems. Adapted TSP Section 100.
• Type I -- Design suitability as of a point in time. No Section IV (tests of controls).
• Type II -- Design suitability AND operating effectiveness over a period (commonly 6-12 months; the AICPA prescribes NO minimum period — shorter initial periods are permitted subject to evidence-sufficiency and user-needs considerations). Includes Section IV with detailed test procedures, samples, and results.

3.2 Key Terminology

• CUEC -- Complementary User Entity Controls. Controls user entities must implement for service org controls to achieve objectives.
• CSOC -- Complementary Subservice Organization Controls. Assumed effective under carve-out method.
• TSC -- Trust Services Criteria (CC1.1-CC9.2 + optional A, PI, C, P criteria). Use "Trust Services Criteria" not "Trust Services Principles" for current engagements.
• Carve-out method -- Subservice controls disclosed but not tested. CSOCs assumed effective.
• Inclusive method -- Subservice controls included in scope and tested directly.
• Opinion types -- Unqualified, Qualified, Adverse, Disclaimer. See chunks/07-opinion-lifecycle-sampling.md.
• Bridge letter -- Management-issued letter covering gap between SOC report periods. No auditor assurance.
• Management assertion -- Written statement by management about fairness of description and control effectiveness. Not a "representation letter."
• Service auditor -- The CPA performing the SOC examination. Not "auditor."

3.3 TSC Categories Summary

Total: 61 criteria. "Sub-criteria" is not a TSC concept — the supporting items are points of focus (~200 after the 2022 revision), which guide evaluation and are not individually required. Verified against TSP Section 100 (2017 TSC, 2022 revised points of focus), 2026-06-10.

3.4 COSO Integration

The 2017 TSC was explicitly modeled on COSO 2013. CC1-CC5 correspond to COSO's 17 principles, mapped SEQUENTIALLY (CC1.1->P1 ... CC1.5->P5; the TSC labels them with the COSO principle text directly). CC6-CC9 are supplemental series of IT-specific criteria.

4. Decision Logic (summary)

Full logic in chunks. Summary:

• Engagement type -- chunks/02-engagement-type-decision.md. Walk through ICFR -> TSC -> Cybersecurity -> Supply Chain.
• Type I vs Type II -- chunks/02-engagement-type-decision.md. First-time -> Type I readiness; established -> Type II (6-12 months).
• Inclusive vs carve-out -- chunks/06-cuec-csoc-inheritance.md. Subservice org has its own SOC report -> carve-out; otherwise consider inclusive.
• Opinion determination -- chunks/07-opinion-lifecycle-sampling.md. Evidence sufficiency -> exceptions in description/design/operating -> unqualified/qualified/adverse/disclaimer.
• Sampling -- chunks/07-opinion-lifecycle-sampling.md. Daily: 25-40, Weekly: 10-20, Monthly: 2-5. Deviation rate vs. tolerable rate.

5. Procedure Templates (summary)

• Engagement classification -- chunks/02-engagement-type-decision.md -- 4-step decision tree.
• TSP criteria scoping -- chunks/03-tsp-criteria.md -- all 33 CC + selected A/PI/C/P criteria with COSO mapping and agent directives.
• CUEC/CSOC identification -- chunks/06-cuec-csoc-inheritance.md -- 5-step identification process for each.
• Opinion determination -- chunks/07-opinion-lifecycle-sampling.md -- 5-step decision tree with compound exception handling.
• Engagement lifecycle -- chunks/07-opinion-lifecycle-sampling.md -- 4-phase lifecycle: Scoping, Evidence, Report Issuance, Monitoring.
• Cross-framework mapping -- chunks/03-tsp-criteria.md -- TSC to COSO, ISO 27001, NIST 800-53, GDPR.

6. Output Templates (summary)

• SOC 1 Type I/II report structure -- chunks/04-report-structures.md.
• SOC 2 Type I/II report structure -- chunks/04-report-structures.md.
• SOC 3 report structure -- chunks/04-report-structures.md.
• SOC for Cybersecurity / Supply Chain -- chunks/04-report-structures.md.
• Management assertion (Type I 2-paragraph / Type II 3-paragraph) -- chunks/05-assertion-bridge.md.
• Bridge letter (4-attestation format) -- chunks/05-assertion-bridge.md.
• Board-ready audit committee deck -- assets/board_deck_template.md.

7. Cross-References (summary)

Full crosswalk in chunks/03-tsp-criteria.md. Quick map:

External: ISO 27001:2022 Annex A, GDPR Articles 6-79, NIST CSF 2.0, HIPAA Security Rule, CMMC 2.0.

8. Worked Examples (summary)

Full worked examples live in use-cases/. Each has complete input, procedure, expected output, and oracle.

9. Anti-Hallucination Disclaimers

• TSC criteria count -- AICPA commonly references ~66 criteria when including refined sub-criteria. Exact count varies by publication (63-69 depending on how CC6-CC9 sub-criteria are counted). Verify against current TSP Section 100.
• SOC for Cybersecurity and SOC for Supply Chain are emerging products with guidance still evolving. Consult AICPA directly for current status.
• SOC 1 control objectives are management-defined, not standardized. Do not invent specific control objectives.
• Opinion determination is professional judgment. The decision tree encodes the framework; the practitioner makes the call.
• SAS 70 and SSAE 16 are superseded -- never reference in current engagements. The current codification is SSAE 18 (AT-C), as amended by SSAE 19-22.
• SSAE 21 did NOT supersede SSAE 18 — it amended the AT-C codification, adding AT-C 206 (direct examinations) and renaming AT-C 205, effective for reports dated on/after June 15, 2022. The citable sections are AT-C 105, 205 (SOC 2/3), 210 (review), 215 (AUP), 320 (SOC 1) — "AT-C 100/200/300" are series groupings, not citable sections.
• Sampling sizes are minimums. Adjust upward for higher-risk controls or when deviations are found.
• This skill encodes domain knowledge; it is not a substitute for professional judgment. Always verify outputs against the cited authoritative source.

10. References & Citation Manifest

In-body citations use the form [LABEL N] and resolve to this manifest.

11. Routing

This is a router. Load chunks based on the user's intent.

Industries (load matching file from industries/): saas-technology, financial-services, healthcare, public-sector, other.

Use cases (load matching file from use-cases/): UC-01 (SOC 2 Type II), UC-02 (CUEC/CSOC), UC-03 (Bridge letter), UC-04 (Auditee preparation).

12. Operational Quick-Reference

The minimum cycle (always-loaded; no chunk needed for the high-level flow):

1. Classify the engagement -> chunks/01-soc-overview.md + chunks/02-engagement-type-decision.md. Output: SOC type + Type I/II.
2. Scope TSC criteria -> chunks/03-tsp-criteria.md. Output: criteria list (33 CC + optional).
3. Identify subservice orgs -> chunks/06-cuec-csoc-inheritance.md. Output: CUEC/CSOC list + inclusive vs. carve-out.
4. Plan examination -> chunks/07-opinion-lifecycle-sampling.md. Output: sample strategy, examination period.
5. Draft report -> chunks/04-report-structures.md. Output: complete report sections.
6. Issue opinion -> chunks/07-opinion-lifecycle-sampling.md. Output: opinion type + exception analysis.
7. Post-issuance -> chunks/05-assertion-bridge.md. Output: bridge letter if needed.
8. Questionnaire reuse -> chunks/08-questionnaire-reuse.md. Output: mapped evidence for CAIQ/SIG/VSAQ.

Board deck: Use assets/board_deck_template.md for quarterly audit committee presentations.