SOC 1 (SSAE 18 / ISAE 3402) D.8: SOC 1 D.8 Communication of noncompliance, fraud or uncorrected misstatements that may affect user entities

Where the service organisation is responsible for fraud, for uncorrected misstatements or for breaches of laws or regulations that are more than clearly trivial and could affect user entities, the service organisation communicates the matter appropriately to the affected user entities; if it does not, the auditor takes appropriate action, which the auditor's engagement letter and the report's other communication responsibilities anticipate.