What the AICPA’s New AI Guidance Means for SOC 1 and SOC 2 Examinations

New AICPA guidance confirms that existing SOC 1 and SOC 2 frameworks can address a service organization’s use of artificial intelligence. However, organizations may need to reassess their risks, controls, system descriptions, governance, and third-party relationships.

AI is becoming part of business processes ranging from software development and anomaly detection to decision-making that can affect financial reporting. For service organizations undergoing SOC 1 or SOC 2 examinations, that raises a practical question: Does the use of AI require an entirely new assurance framework?

The AICPA’s answer is no. TQA Section 9561, “SOC Examinations: Effect of the Service Organization’s Use of AI on SOC 1 and SOC 2 Examinations,” explains how a service organization’s use of AI fits within existing SOC examinations. For SOC 2 engagements, the existing trust services criteria remain applicable because they are designed to be independent of any particular technology or process.

The analysis begins not with the technology itself, but with what AI does, which risks it affects, and whether it is relevant to the system under examination.

The guidance addresses how a service organization’s use of AI may affect a SOC 1 or SOC 2 examination. It does not establish an examination of the AI system itself or provide guidance for examining AI-specific functionality, such as model performance.

Where AI Fits Into a SOC 1 Examination

For a SOC 1 examination, the key issue is whether an organization’s use of AI is likely to be relevant to user entities’ internal control over financial reporting, or ICFR.

If AI performs services or operates controls that affect information used to prepare user entities’ financial statements, the AI components may be relevant to ICFR. Factors that may inform that determination include AI’s role in delivering the service, the level of human involvement, and whether AI introduces or mitigates risks to achieving control objectives.

One example in the AICPA guidance illustrates the significance of human oversight: AI used to help draft code may present a different consideration when a developer fully reviews and corrects that code than when the organization relies more directly on the AI output.

Importantly, AI generally affects existing financial statement assertions and control objectives. Its use may not require additional AI-specific control objectives. Instead, AI may change the risks threatening existing objectives and the controls needed to address those risks.

SOC 2 Criteria Still Apply in an AI-Enabled Environment

For SOC 2 examinations, AI’s relevance depends on its effect on the services and systems within scope.

AI may be relevant when it affects the services provided, the system’s security, availability, or processing integrity, or the confidentiality or privacy of information processed by the system. The selected trust services categories, service commitments, and system requirements remain important considerations when determining that relevance.

The AICPA confirms that existing trust services criteria can be used when a service organization uses AI. Because the criteria are technology-independent, a separate set of criteria is not inherently required simply because AI has entered the environment. Depending on the circumstances, however, management and the service auditor may identify additional points of focus when evaluating AI-related controls.

AI may also prompt an organization to reconsider the trust services categories included in an engagement. Omitting a category that is important to intended users could result in a misleading report.

AI Changes the Risk Conversation

Using an existing SOC framework does not mean the organization’s risk profile remains the same. AI-related risks can affect existing SOC 1 control objectives or SOC 2 service commitments and system requirements.

Depending on how AI is used, the AICPA identifies a range of AI-related risks for organizations and auditors to consider, including:

• Accuracy and reliability risks related to data and model outputs

• Hallucinations, including outputs that appear credible but are incorrect
• Bias in data, models, or resulting decisions
• Explainability and interpretability challenges
• Security threats
• Confidentiality and privacy concerns

These risks make an organization’s risk assessment central to determining how its use of AI may affect a SOC examination.

System Descriptions May Need to Evolve

When AI is relevant to a SOC 1 or SOC 2 examination, the organization may also need to update its system description.

Depending on the circumstances, that description could address how AI supports the services in scope, the types of AI used, how AI-related risks and governance are managed, and any applicable complementary controls. The goal is to give report users sufficient information to understand how AI affects the system and its control environment, including financial -reporting risks in a SOC 1 examination or risks to service commitments and system requirements in a SOC 2 examination.

Don’t Overlook AI Governance

Governance also moves closer to the center of the SOC conversation when AI is relevant.

The AICPA describes AI governance as the frameworks, policies, and processes used to responsibly and ethically develop and deploy AI components. When AI is relevant to the system under examination, the organization’s risk assessment is expected to consider AI-related risks. AI governance controls may also be relevant to the service auditor’s understanding of the system and may need to be reflected in the system description.

Relevant considerations may include the organization’s AI strategy and governance processes, visibility into how AI is used, the complexity and integration of AI components, oversight responsibilities, and the use of third-party AI.

What Service Organizations Should Take Away

The AICPA guidance gives organizations an important point of clarity: Adopting AI does not automatically require a new SOC framework. It does require a careful assessment of relevance and risk.

As a practical first step before the next SOC examination, organizations can identify where AI is used across the services and systems in scope. They can then assess whether that use affects existing risks, controls, service commitments, system requirements, or disclosures.

Where AI is relevant, organizations may need to revisit:

• Risk assessments
• Control design and operation
• System descriptions
• AI governance and oversight
• Third-party relationships
• The trust services categories included in a SOC 2 examination

AI technology may be new, but the underlying assurance question is familiar: What risks matter to users, and are appropriate controls in place to address them?

Organizations that answer that question early can approach discussions about AI and their SOC examinations with greater clarity.

Questions about how AI could affect your organization’s SOC 1 or SOC 2 examination? Connect with CBIZ CPAs to discuss your current environment and considerations for your next examination.