SOC 2 management assertion template
Updated
The management assertion is the company's own written statement inside a SOC 2 report. A free Word draft to prepare it with your CPA firm, plus a check of the fields that most often cause mismatches with the report. Your CPA firm provides the required wording, and its own template governs.
Read this before you use the draft. A SOC 2 report is a CPA firm's attestation, and the assertion is management's statement, not the firm's. The draft does not state, for you, that the description is fairly presented, that the controls were suitably designed or that they operated effectively. Those are conclusions management makes only after its own review, with evidence, and in the firm's wording, so they are placeholders. Replace every [Fill in: ...].
What the management assertion is, and where it sits in the report
Scrut's guide lists the sections of a SOC 2 report in order: the independent auditor's opinion, the management assertion, the system description, then the controls with the auditor's tests and results, and optionally management's response (Scrut: what is a SOC 2 report). So the assertion comes after the auditor's report and before the description it refers to. Agency calls it Section II of the report and says it is the written statement the auditor examines and gives an opinion on (Agency: SOC 2 management assertion).
It is short, usually a page on the company's letterhead, and it must agree with the rest of the report. The system description is the document it points to, so draft the two together.
What it states
Secureframe's sample wording has three confirmations, tied to a stated period (Secureframe: how to write a SOC 2 management assertion). In plain terms, management states:
- About the description. Whether the description of the system is fairly presented for the period or date, measured against the description criteria.
- About the design. Whether the controls were suitably designed to meet the service commitments and system requirements, measured against the trust services criteria.
- About the operation (Type II). Whether the controls operated effectively throughout the period. In Secureframe's sample this is stated together with the condition that the complementary subservice organization and user entity controls also operated.
Each is a conclusion, and management is the one making it. That is why the Policyseed draft does not write any of them for you: it names the topic, then leaves a placeholder that points to your CPA firm's wording and says when management may make the statement. A company that has not completed an examination should not hand a customer or an auditor pre-written wording that says its controls worked.
Who signs, and why the firm's template wins
Agency says the signer is the most senior person who knows the system and can bind the company: at a startup, usually the CEO or CTO; at a larger company, possibly the CISO or a compliance officer. It adds that nearly every audit firm provides a template matched to its opinion letter, which management adapts, and that the firm cannot write management's claims for it (Agency).
So treat this page as preparation. Use the draft to gather the facts and to see the shape, then put the final statements into the firm's template. Where the draft and the template differ, the template governs, because it is matched to the firm's report.
What to verify before signing
Agency lists the system name, audit period, trust services categories and subservice organizations as the details to verify, with dates that match the auditor's report and the system description. The draft's last page expands that into a checklist:
| Check | Compare against |
|---|---|
| System name | The name on the report cover, in the system description and in the auditor's report. Use it exactly as written there. |
| Type I date or Type II period | The dates in the auditor's report and the system description. All three should show the same dates. |
| Trust services categories in scope | The engagement letter and the system description. Name each category the report covers, and no others. |
| Each subservice organization and how it is treated | The subservice section of the system description and your vendor list. Name each one the description names, and say whether it is carved out or included, as the description does. |
| Pointer to complementary user entity controls | The place in the system description where they are listed. Point to that section by its title. |
| Criteria wording | The CPA firm's template. Use its names for the trust services criteria and the description criteria. |
| Signer | A person with knowledge of the system and authority to act for the company. Ask the firm who it expects. |
| Signature date | The date the CPA firm expects. Confirm when it needs the signed version. |
For subservice organizations, start from your vendor list; the Vendor and Third-Party Risk Management Policy says where that list lives. For the pointer to complementary user entity controls, see complementary user entity controls. If you are not sure which categories are in scope, the SOC 2 gap assessment is the place to settle that first.
Assertion vs auditor's opinion vs bridge letter
| Document | Written by | Covers | Examined by the CPA firm |
|---|---|---|---|
| Management assertion | Management, signed by an officer | The system description, the design of the controls and, for Type II, their operation, for the report period or date | Yes. It is part of the report, and the CPA firm examines it. |
| Auditor's opinion | The CPA firm | The firm's conclusion on the same matters, based on its examination | It is the firm's own report |
| Bridge letter | Management, signed by an officer | The time after the report period or date, up to the letter date | No. It is outside the report, and the auditor is not involved. |
The bridge letter template is the matching tool for the third row. It is management's representation about the time after the report, and it must not claim that controls operated effectively in that time; only an examination can support that. For why the report as a whole is an attestation and not a certificate, see is SOC 2 a certification?
Type I and Type II variants
| Topic | Type I | Type II |
|---|---|---|
| Covers | One date | A period |
| The description | As of the date, and as designed and implemented at that date | For the period |
| Design of the controls | As of the date | Throughout the period |
| Operation of the controls | Not part of a Type I report | Throughout the period |
Pick the type in the form and the draft shows the matching fields: a single as-of date for Type I, a start and end for Type II, and the operation item only where it belongs. How long a Type II period should be is a question for the firm; see the SOC 2 observation period guide.
Frequently asked questions
- Is there a free SOC 2 management assertion template?
- Yes. This page has a Word draft built in your browser, with no signup and nothing uploaded. It is a draft for preparing, not a finished assertion: the statements about the system description, the design of the controls and (for Type II) their operation are left as placeholders for the wording your CPA firm requires. The firm usually supplies its own template matched to its report, and that template governs.
- Who signs a SOC 2 management assertion?
- An officer who knows the system and has authority to act for the company. Agency says it is the most senior person with real knowledge of the system and the authority to bind the company, which at a startup is usually the CEO or CTO. Ask your CPA firm who it expects, because the signature is management's statement, not the firm's.
- Is the management assertion the same as the auditor's opinion?
- No. The assertion is management's written statement and is part of the report. The auditor's opinion is the CPA firm's own conclusion, reached by examining the system description, the design of the controls and, in a Type II report, their operation. Agency describes the assertion as the statement the auditor examines, so the opinion rests on it, but the two are written and signed by different parties.
- How is it different from a bridge letter?
- A bridge letter covers the time after a report's period or date, up to the day management signs it, and it sits outside the report. The assertion is part of the report and covers the report's own period or date. A bridge letter has no auditor involvement. The free bridge letter template on this site is a separate tool.
- Should I use this draft or my CPA firm's template?
- Use the firm's template for the version you sign. This draft helps you gather the facts the assertion needs (system name, period or date, categories in scope, subservice organizations) and check them against the report before the firm's wording arrives. Where the two differ, the firm's wording wins.
- When does the signed assertion have to be ready?
- Ask your CPA firm. The sources checked for this page place the assertion inside the final report, after the auditor's report and before the system description, so the firm will tell you when it needs the signed version and which date it expects on it. Do not sign a statement about controls until you have the evidence for the whole period behind it.
- What is different for Type I and Type II?
- A Type I assertion is about one date and covers the description and the design of the controls as of that date. A Type II assertion is about a period and adds a statement that the controls operated throughout it. The draft drops the operation item when you pick Type I and flags it as Type II only when the type is left open.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.