AICPA Guidelines

Evidence collection is the first step towards gaining your SOC 2 attestation. It provides proof that your policies, processes, workflows, The AICPA (American Institute of Certified Public Accountants) created the SOC 2 framework. They are the reason only licensed CPAs are allowed to issue SOC 2 reports. That also means there’s no central certifying body or stamp of approval – your report’s weight comes from the firm’s reputation and their alignment with AICPA’s standards.

Here are some of the main AICPA guidelines at a glance:

• Consistency with AICPA’s attestation standards (specifically SSAE 18) is critical
• Audits must align with the Kriterien für Vertrauensdienste (Security, Availability, etc.)
• CPAs must maintain independence and apply professional judgment
• Reports should be tailored, meaning that AICPA encourages a risk-based, context-driven approach
• Documentation and evidence must support all audit findings