What Is AT-C 315?
The AICPA's AT-C Section 315 ("Compliance Attestation") provides updated guidance for how CPA firms conduct SOC 2 examinations. While the Trust Service Criteria remain unchanged, AT-C 315 clarifies risk assessment procedures, evidence evaluation standards, and reporting requirements — resulting in more rigorous audits with higher evidence quality expectations.
Key Changes Under AT-C 315
Enhanced Risk Assessment
Auditors must now perform more formal risk assessment procedures before determining the nature and extent of testing. This means your evidence package needs to demonstrate risk-based control design, not just control existence.
Tighter Sampling Requirements
AT-C 315 provides more prescriptive guidance on sample sizes for testing. Expect auditors to request larger samples for high-risk controls — particularly access management and change management.
Management Assertions Update
The System Description must now explicitly address how management identifies and monitors risks related to the Trust Service Criteria — not just describe what controls exist.
Subservice Organization Carve-outs
Reporting on subservice organizations (like AWS or Salesforce) requires more explicit handling. Your complementary user entity controls must be more precisely mapped.
What This Means for Your Evidence Package
The practical implication: evidence that passed muster in a 2022 or 2023 SOC 2 audit may not satisfy an AT-C 315-aligned examination in 2025 or 2026. Specifically:
- Screenshots alone are often insufficient — auditors want system-generated exports with timestamps
- Access review evidence must show the review process and outcomes, not just a user list
- Change management evidence must include approval workflows, not just deployment logs
- Incident response testing evidence should include tabletop exercise documentation
- Vendor management evidence must show assessment methodology and findings, not just agreements
- The best preparation for AT-C 315 is continuous, system-generated evidence collection. Iron Fort exports audit-ready evidence directly from your infrastructure — eliminating the manual screenshot-gathering that auditors increasingly reject.
Get Audit-Ready with Iron Fort
Iron Fort collects system-generated evidence daily from 40+ integrations — formatted exactly as AT-C 315-aligned auditors expect. Book a free scoping call at goironfort.com/demo.