The American Institute of CPAs (AICPA) has opened a public consultation on proposed changes to the SOC 2 Trust Services Criteria, the framework used by licenced independent CPAs to assess controls over organisations’ information systems .
An SOC 2 examination is conducted under AICPA Attestation Standards and considers controls related to system security, availability, processing integrity, confidentiality, and privacy.
Access deeper industry intelligence
Experience unmatched clarity with a single platform that combines unique data, AI, and human expertise.
The proposed revision would reorganise the criteria with the aim of making SOC 2 reports clearer and easier for users to interpret.
It would combine overlapping concepts, remove criteria where they are no longer needed, introduce requirements in areas needing greater attention, and revise existing wording to apply a consistent standard across the framework.
The exposure draft also addresses technological developments. New points of focus cover AI governance, model monitoring, prompt manipulation, data poisoning, disclosure of AI-generated outputs, management of training data, and risks arising from automated decision-making.
The proposed additions are intended to support organisations and auditors in assessing whether controls adequately respond to risks associated with advanced technologies.
The AICPA’s SOC 2 Working Group will be accepting public comments on the exposure draft until 15 January 2027.
Subject to approval, the 2027 SOC 2 Trust Services Criteria would apply to engagements starting on or after 31 December 2027. Early adoption would be allowed.
AICPA assurance and advisory innovation vice-president Amy Pawlicki said: “The way organisations manage and process information and identify risk has changed substantially over the past decade.
“These proposed revisions are intended to improve the usability of SOC 2 reports and refine criteria so they can adapt to rapidly evolving technologies.”
