# System and Organization Controls System and Organization Controls is the American Institute of Certified Public Accountants’ suite of assurance services for reporting on controls at service organizations and in other system contexts. ## Historical and Technical Context SOC reporting developed from earlier service-auditor reporting practices and now includes several report families. SOC 2 evaluates controls relevant to the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. A Type II report evaluates both control design and operation over a specified period; “Level II” is not the standard term. The notebook uses the older or approximate phrase “service organization control.” The canonical AICPA expansion is System and Organization Controls. ## Role in Scanned_20260730-1802 Pages 40 and 42 use SOC as both a disambiguation problem and a platform for original synthesis. Page 40 distinguishes SOC from Security Operations Center, System on a Chip, military commands, and government abbreviations. Page 42 then expands assurance language into governance, risk, espionage, actuarial reasoning, investment, competition, relationships, and trust. This is where the notebook’s technical systems map becomes an organizational survival model: trust is infrastructure, and continuity must be demonstrated as well as implemented. ## Notebook Evidence - `Scanned_20260730-1802.pdf`, PDF page 40: "\"SSC (Compliance) - AICPA -\"" - `Scanned_20260730-1802.pdf`, PDF page 42: "\"AICPA\"" - `Scanned_20260730-1802.pdf`, PDF page 42: "\"SOC / Soc Level II Cyber security\"" - `Scanned_20260730-1802.pdf`, PDF page 42: "\"service organization control\"" - `Scanned_20260730-1802.pdf`, PDF page 42: "\"- Trust Services -\"" - `Scanned_20260730-1802.pdf`, PDF page 42: "\"Relationships & Trust...\"" **Visible evidence:** AICPA, SOC, “Level II,” Trust Services, governance, and risk. **Independently verified correction:** the formal terms are System and Organization Controls and SOC 2 Type II. **Plausible interpretation:** the author intentionally generalizes audit controls into strategic and sociopolitical continuity. ## Relationships [[American Institute of Certified Public Accountants|AICPA]] defines the suite, and [[Trust Services Criteria|Trust Services Criteria]] structure SOC 2 evaluation. [[Chief Information Security Officer|CISO]] is the adjacent governance role. [[Continuity Architecture|Continuity Architecture]] links operational resilience to evidence, accountability, and trust. ## Cross-Notebook Significance The reconstruction provisionally links this page to later work on institutional opacity, narrative control, and continuity. `Scanned_20260730-1825.pdf`, pages 1–2, includes “convey your narrative to control,” which may extend the governance concern but does not establish a direct SOC reference. ## Missed Signals and Open Leads Separate AICPA terminology from the notebook’s original extensions. Resolve “minimizing elimination” and determine whether it refers to competitive displacement, existential risk, or another control objective. ## Sources - [AICPA & CIMA, “System and Organization Controls: SOC Suite of Services”](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) - [AICPA & CIMA, “Trust Services Criteria”](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) - `Scanned_20260730-1802.md`, PDF pages 40 and 42. ## Scanned_20260730-1825 overlay PDF page 2 of [[Scanned_20260730-1825]] supplies the later documentary-governance analogue previously referenced only by its PDF filename. [[Wipfli]] underwriting and loan-review language leads to the recognition that an institution acts on the file and narrative presented to it. This does not make the page a direct SOC-control reference. It shows why provenance, completeness, review criteria, and documentary sufficiency matter to assurance: [[Narrative Control]] becomes legitimate governance only when the underlying record is traceable and testable.