SOC Radar
Global SOC Assurance Intelligence & Insights
SOC Radar is a specialized intelligence and knowledge platform dedicated to the System and Organization Controls (SOC) assurance ecosystem.
We monitor AICPA publications, professional standards, changes in examination practices, auditor independence and quality developments, emerging technologies, and significant events affecting information security, internal controls, and third-party risk management.
Our coverage includes SOC 1, SOC 2, SOC 3, SOC 2+, SOC for Cybersecurity, SOC for Supply Chain, and the STAR program.
SOC Radar goes beyond conventional news reporting. We combine verified information with independent expert commentary and practical recommendations to explain what developments mean for service organizations, auditors, management teams, and users of SOC reports.
Why follow SOC Radar?
The SOC assurance landscape is evolving rapidly. Compliance automation, artificial intelligence, increasingly complex outsourcing models, and growing scrutiny of audit quality are changing how organizations prepare for, perform, and rely on assurance engagements.
Understanding these developments requires more than following standards updates. It requires a critical assessment of professional guidance, market practices, control failures, emerging risks, and the credibility of assurance processes.
SOC Radar brings these perspectives together in one place.
Outsourced processes: AICPA revisits user auditor responsibilities
19.02.2025
SOC 1
Facts and context
The AICPA CPEA report of 19 February 2025 examines the responsibilities of financial statement auditors when clients outsource processes such as payroll, accounting and IT. Its review of 2024 peer-review matters identifies three recurring documentation gaps: understanding the provider’s relevant controls, evaluating the SOC 1 report, and assessing complementary user entity controls (CUECs). These are findings about the user auditor’s work, rather than evidence that the underlying SOC reports are defective.
The report explains application of AU-C 402. The auditor considers the relevance of the outsourced services, the service auditor’s competence and independence, the report’s date or period, and whether it supplies appropriate evidence. Reviewing the complete report matters: the opinion, system description and, for Type 2, tests and results must be connected to the user entity’s financial reporting. Services outside the report’s scope require separate consideration.
CUECs are controls assumed to operate at the customer. Relevant controls require evaluation of design and implementation; reliance on operating effectiveness can require testing. The full report was reviewed for this update. It is non-authoritative CPEA guidance explaining existing requirements, rather than a new auditing standard.
Link
Comments
A useful SOC review ends with a documented reliance decision. A file containing a supplier’s report is incomplete if nobody has assessed its relevance, exceptions and required user controls.
Recommended actions
1. Map outsourced processes to financial reporting risks.
2. Check the report scope and period.
3. Assign owners to complementary user entity controls (CUECs).
4. Record gaps and required additional procedures.
GAO examines modified SOC 1 opinions at U.S. Defense service organizations
18.09.2025
SOC 1
Facts and context
On 18 September 2025, the U.S. Government Accountability Office published GAO-25-107731 on the role of SOC 1 reports in evaluating internal controls within Department of Defense service organizations. These providers support centralized functions such as payroll and accounting. The study examined reporting for fiscal years 2020–2024 and selected eight SOC 1 reports for closer investigation, supported by interviews with providers, auditors and users.
GAO identified recurring deficiencies in logical access, configuration management, segregation of duties and transaction processing. These areas contributed to modified opinions. Outcomes were not uniform: opinions for some selected systems changed across the reviewed years, while others remained modified or unmodified.
The report also examined remediation. Most selected organizations had performed root-cause analyses, but documentation practices differed. In January 2025, DOD updated its guidance on documenting those analyses. The study therefore addresses both the weaknesses reported by service auditors and efforts to understand their causes. Its publication date should not be confused with the earlier periods covered by the underlying examinations.
Link
Comments
We recommend assessing the quality of remediation evidence, including whether it addresses the cause of a weakness and demonstrates sustained operation. A revised procedure alone offers limited support for a conclusion about effectiveness.
Recommended actions
1. Link each finding to affected processes.
2. Assess relevant CUECs.
3. Request remediation evidence and retest dates.
4. Determine whether compensating controls are needed.
B. Riley discloses SOC 1 reliance problems in financial reporting controls
19.09.2025
SOC 1
Facts and context
B. Riley Financial’s Form 10-K for the year ended 31 December 2024 was filed with the SEC on 19 September 2025. In its internal-control disclosures, the company identified a material weakness involving inability to rely on SOC 1 Type 2 reports for two providers supporting B. Riley Retail Solutions. The disclosure refers to inadequate IT general controls over relevant systems and reports.
The filing separately records remediation at Marconi Wireless: reliance on its provider’s SOC 1 Type 2 report had been restored in conjunction with complementary user entity controls. These disclosures concern different situations and should not be combined into one continuing failure.
The distinction is important to the chronology of this case. An annual filing can describe both weaknesses identified in the reporting period and earlier weaknesses that have been addressed. This entry concerns the company’s historical assessment of internal control over financial reporting. It does not establish the current condition of those controls, or that the service auditors fabricated reports or breached professional standards.
Link
Comments
A review should connect provider controls, system-generated information and the user’s financial assertions. Where a report cannot support reliance, management needs a reasoned response. The filing does not establish that the reports were fabricated or that the service auditors breached standards.
Recommended actions
1. Separate current weaknesses from remediated issues.
2. Identify reports used in financial controls.
3. Evaluate ITGCs and data completeness and accuracy.
4. Document additional testing or compensating controls.
CSA launches STAR for AI: distinguish self-assessment from independent assurance
23.10.2025
CSA STAR for AI
Facts and context
On 23 October 2025, CSA announced STAR for AI, built around its AI Controls Matrix and mapping to ISO/IEC 42001. Level 1 allowed publication of AI CAIQ self-assessments in the STAR Registry.
The announcement described the forthcoming Level 2 route through ISO/IEC 42001 certification combined with a scored self-assessment, with availability planned for November. It also introduced implementation and auditing guidance.
This dated announcement establishes the programme’s initial stages. It does not establish that a SOC 2-based AI attestation was available on the same date.
Link
Comments
Editorial assessment: a registry badge needs to be read together with the assessment route, system boundary and independent report. A self-assessment can improve transparency, but provides a different basis for reliance from a CPA examination. Track STAR for AI separately from conventional cloud STAR Attestation.
Recommended actions
1. Identify the assessment route and level.
2. Record the AI system and provider role covered.
3. Separate self-assessment disclosures from independent assurance.
4. Verify later programme requirements before commissioning an engagement.
CCM 4.1 updates the cloud control framework used in STAR assurance
27.01.2026
SOC 2; CSA STAR Attestation
Facts and context
CSA’s CCM and CAIQ 4.1 resource is dated 27 January 2026. It describes 207 controls across 17 domains, with implementation and auditing guidance and mappings including NIST 800-171, MITRE ATT&CK and DORA.
The package distinguishes the reference CAIQ within the control workbook from the separate questionnaire accepted for STAR Registry submissions. Its supporting materials include a change analysis.
This is a new version of the CSA cloud control framework. It does not itself amend AICPA Trust Services Criteria or demonstrate that an organization has passed an examination.
Link
Comments
Editorial assessment: use the release to reassess the cloud overlay in a planned SOC 2 + CCM engagement. An existing mapping is a starting point; control owners still need to explain changes in implementation, evidence and responsibility. The release date and the mandatory transition date serve different purposes.
Recommended actions
1. Compare the current control set with CCM 4.1.
2. Review changed mappings and evidence requirements.
3. Select the correct CAIQ submission file.
4. Coordinate adoption with the STAR transition timetable.
Fast SOC reports: what buyers should ask about audit quality
1.02.2026
SOC 1; SOC 2
Facts and context
On 1 February 2026, the Journal of Accountancy published a feature examining whether commercial pressure for rapid, high-volume SOC work could undermine assurance quality. Practitioners interviewed for the article described concerns about marketing promises and pressure on audit firms. The discussion also recognized that software can improve evidence collection and interaction with clients.
The issue is therefore how engagements are performed when technology and delivery targets influence the process. The article presents professional concerns and market observations rather than an enforcement finding against a particular firm.
For context, several activities can sit behind a promise of a ‘fast SOC report’: readiness work, evidence collection, examination procedures and report preparation. These activities do not all represent the same period or deliverable. In a Type 2 engagement, the period over which controls are examined is distinct from the time taken to write and issue the report. That distinction helps readers interpret the debate without assuming that every efficient or automated engagement is deficient.
Link
Comments
Procurement teams should compare proposals using the work to be performed. Useful questions concern who tests controls, how exceptions are evaluated and whether the auditor can request evidence outside the platform. Price or speed alone does not establish quality.
Recommended actions
1. Request a clear scope and timeline.
2. Identify the issuing audit firm.
3. Ask how tests and samples are selected.
4. Agree how findings will be communicated.
CSA sets the CCM 4.1 transition timetable for STAR
19.02.2026
SOC 2; CSA STAR Attestation
Facts and context
CSA published its transition timetable on 19 February 2026. Both versions 4.0 and 4.1 would be accepted for STAR Levels 1 and 2 from March 2026. The table schedules 4.1-only submissions for December 2027 and withdrawal of version 4.0.x in January 2028.
The update adds 11 controls, removes one IAM control and revises existing content; CAIQ 4.1 contains 283 questions.
The milestones concern acceptance and maintenance of framework versions. They should not be interpreted as proof that every existing attestation expires on the framework withdrawal date.
Link
Comments
Editorial assessment: align the examination period, readiness work and planned registry submission with the transition. Confirm the precise cut-off with CSA before a late-2027 submission, because the article’s narrative and table describe the boundary differently. Avoid carrying forward the former control mapping without reviewing the revised wording.
Recommended actions
1. Record the version in the engagement scope.
2. Plan a gap assessment and remediation owners.
3. Agree evidence collection for revised controls.
4. Confirm the submission deadline with CSA.
CSA publishes combined CPA guidance for STAR and STAR for AI Attestation
5.03.2026
SOC 2+; CSA STAR Attestation; STAR for AI Attestation
Facts and context
On 5 March 2026, CSA published a resource specifically covering CPAs conducting STAR Attestation or STAR for AI Attestation. Its official description identifies professional requirements, CPA competence and ethics, SOC 2+ engagement scope and criteria, and submission of attestation materials to the STAR Registry.
For context, CSA describes conventional STAR Attestation as a SOC examination supplemented by Cloud Controls Matrix criteria. STAR Certification follows a separate ISO/IEC 27001-based route. A Level 1 self-assessment is a different deliverable.
The verified publication confirms a dedicated CPA guidance resource for both attestation programmes. Detailed eligibility and submission conditions must be checked in the applicable full version; this entry is based on CSA’s public publication and programme descriptions.
Link
Comments
Editorial assessment: distinguish conventional SOC 2 + CCM from the AI-specific attestation route in proposals and marketing. Specify the additional criteria, subject matter, period, independent practitioner and intended users. The common STAR label should not obscure which assessment was actually performed.
Recommended actions
1. Obtain the current CPA guidance and record its version.
2. Confirm applicable criteria for cloud or AI scope.
3. Assess practitioner competence and independence.
4. Confirm registry submission requirements before agreeing deliverables.
Delve disputes SOC 2 allegations and offers customer support measures
24.03.2026
SOC 2
Facts and context
In March 2026, Delve faced public allegations concerning evidence and the SOC 2 examination process. In its response dated 20 March, the company disputed the claims and described itself as an automation platform supporting preparation and evidence organization. It stated that independent, licensed auditors test controls and issue final reports.
On 24 March, Delve announced optional re-audits and penetration tests at no charge, as well as access to auditors’ engagement letters. It also announced clearer template disclosures and more direct communication between customers and auditors. The company published a further response on 3 April.
The verified sources document Delve’s statements and announced measures. They do not independently establish either the truth or falsity of the underlying allegations, or completion of every promised measure. The case concerns the boundaries between preparation support, evidence of actual control operation and independent examination. A chronology of statements and offers should remain separate from any conclusion about misconduct.
Link
Comments
The useful lesson is to verify evidence provenance and direct access to the auditor. A template can structure documentation, but the organization still needs records demonstrating what actually happened. These principles do not determine whether the disputed allegations are true.
Recommended actions
1. Confirm the issuing firm and engagement letter.
2. Trace selected evidence to original systems.
3. Ask the auditor to explain tests and exceptions.
4. Assess additional procedures where evidence is unreliable.
AICPA ethics staff examines relationships with SOC 2 tool providers
6.04.2026
SOC 2
Facts and context
On 6 April 2026, AICPA Professional Ethics Division staff published an article on business arrangements between SOC auditors and SOC 2 tool providers. It discusses circumstances in which contracts or commercial relationships can influence scope, timing, evidence access, financial dependency or professional judgment. These relationships can create threats to independence and objectivity that require assessment under existing ethical requirements.
The article distinguishes the service auditor, the service organization and the tool provider. It also addresses situations involving a responsible party or network relationships. It does not announce a new SOC examination framework or find that every software partnership is impermissible.
For context, a customer may experience a bundled commercial service even when the software provider and audit firm are separate entities. The appearance of a single delivery process does not remove the distinct responsibilities of management and the auditor. This explains why the terms governing access, communication and decisions matter alongside the technical capabilities of the platform.
Link
Comments
We recommend mapping responsibilities before signing a combined software and assurance package. The map should identify who owns controls, supplies evidence, designs tests and issues the report. Ambiguity at these boundaries can become a practical obstacle during the examination.
Recommended actions
1. Review commercial and referral arrangements.
2. Preserve direct auditor communication.
3. Confirm unrestricted access to necessary evidence.
4. Document the auditor’s independence assessment.
AICPA explains why a quick-turn SOC badge cannot replace the report
30.04.2026
SOC 2
Facts and context
In the Journal of Accountancy podcast of 30 April 2026, AICPA’s Amy Pawlicki explains SOC 2 as a CPA examination rather than a certification. She distinguishes useful automation from promises of standardized, extremely fast assurance.
The discussion emphasizes differences in scope, business complexity and Trust Services Categories, together with practitioner competence, independence and peer review. It also raises concerns about alleged boilerplate reports signed without substantive auditor involvement.
These are professional observations and warnings, not an adjudicated finding against a named vendor. The accompanying Ethics Staff Insights resource addresses commercial relationships with tool providers.
Link
Comments
Editorial assessment: obtain the report and understand what was examined before relying on a badge. In procurement, compare actual scope, evidence access and who makes examination decisions. A fast delivery schedule alone does not establish that work is deficient; unsupported conclusions and absent practitioner involvement are more meaningful warning signs.
Recommended actions
1. Request the actual SOC report.
2. Confirm the issuing CPA firm and scope.
3. Check how the auditor obtains and evaluates evidence.
4. Review relationships with platform providers and the firm’s quality arrangements.
AICPA directs peer reviewers to examine SOC 2 quality risks
14.05.2026
SOC 2
Facts and context
On 14 May 2026, AICPA’s technical director for Peer Review described guidance addressing risks in SOC 2 practices, particularly where firms handle large volumes or rely heavily on platforms. The article identifies unrealistic timelines and insufficient tailoring of risk assessments or tests as warning signs. Reviewers may respond by examining multiple engagements and comparing work across clients or years.
Where work fails to comply with professional standards in material respects, an engagement may be classified as nonconforming. Depending on the findings, follow-up can involve changes to quality management or external reviews of completed work. The response is risk-based, rather than a universal fixed sample size.
For context, peer review evaluates a firm’s professional work and quality processes. It is distinct from the SOC examination of an individual service organization. The publication therefore concerns how the profession evaluates audit quality, rather than adding new controls for every SOC 2 client. Its announced future monitoring arrangements should also be distinguished from evidence that those arrangements have been implemented.
Link
Comments
We recommend inspecting the decisions that templates cannot make: why a control matters, how the tested population was established and what an exception means. Consistency of format can improve efficiency; unsupported uniformity of conclusions can conceal weaknesses.
Recommended actions
1. Review a sample of completed engagements.
2. Compare risk assessments and testing rationales.
3. Check partner involvement and supervision.
4. Address recurring weaknesses in quality management.
AICPA publishes TQA 9561 on AI use in SOC 1 and SOC 2 examinations
11.09.2026
SOC 1; SOC 2
Facts and context
AICPA’s TQA Section 9561, published in September 2026 with a landing-page date of 11 September, addresses AI used by the service organization in SOC 1 and SOC 2 examinations. The full document has now been reviewed. In SOC 1, relevance depends on how AI affects user entities’ internal control over financial reporting, including reliance on AI outputs and the nature of human review.
For SOC 2, the analysis links AI to service commitments, system requirements and the selected Trust Services Categories. Existing Trust Services Criteria remain technology-neutral and applicable. Section .12 warns that limiting a report to security may be misleading where users principally need assurance over AI processing integrity; the auditor may discuss expanding scope or decline an inappropriate engagement. This is not a requirement to include every category in every AI-related examination.
Sections .20–.24 address team competence, system descriptions, risk assessment, AI governance and external AI providers, including subservice-organization considerations. The opening scope note expressly excludes a direct opinion on an AI system or model performance. The guidance concerns AI within the examined service organization, rather than the audit firm’s own use of AI.
Link
Comments
Editorial assessment: scope should follow the actual service, AI dependencies and users’ information needs. A security-only report may leave material questions about processing integrity unanswered. A SOC report should not be marketed as a blanket validation of model accuracy or AI safety.
Recommended actions
1. Map AI uses to ICFR or service commitments.
2. Reassess selected Trust Services Categories.
3. Update the system description and AI risk assessment where relevant.
4. Evaluate team competence, governance and external AI dependencies.