SOC 2 Type II — Management Assertion

Executive Summary

Acme Corp's codebase was assessed against the AICPA Trust Services Criteria (2017, with 2022 revisions) (SOC 2 Type II Type II) using automated code-level analysis. The assessment covers 13 controls, of which 6 are testable at the code level (46% coverage).

• Controls implemented: 4
• Controls with gaps: 0
• Controls partially implemented: 2
• Controls outside code scanning scope: 7

Key Findings

• CC5.1 Technology General Controls — 2 finding(s), severity Medium
• CC6.6 System Boundaries — 2 finding(s), severity Medium

Scope & Limitations

This assessment covers CODE-LEVEL controls only. The following areas require separate, organizational assessment:

• CC1.1 COSO Principle 1 — Integrity & Ethics
• CC2.1 Information for Internal Use
• CC3.1 Risk Assessment
• CC4.1 Design & Operate Monitoring Controls
• CC6.3 Access Removal
• CC7.1 Monitoring of Controls
• CC8.1 Change Management

Disclaimer: Code-level controls only. Coverage percentages reflect how many framework controls have matching RepoScope detectors. This is a development aid, not a certification tool — auditors make the final determination.

Attestation

I, the undersigned, have reviewed the above assessment and confirm that:

1. The scope and limitations are understood.
2. The identified gaps will be addressed per the remediation plan.
3. Controls outside code scanning scope are managed through separate processes.
4. I assert that the controls described above are presented in accordance with the applicable Trust Services Criteria.

Name: Dana Lee
Title: Chief Information Security Officer
Signature: ____________________
Date: ____________________