TQA Section 9560.01−.06

The AICPA has issued Technical Questions and Answers (TQAs) 9560.01−.06 related to the inclusion of information about controls over cryptographic keys in management’s description of a service organization’s system in a SOC 1 report. An examination of management’s description of a service organization’s system and the suitability of the design and operating effectiveness of controls included in the description is performed under AT-C section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal