# Attestation — definition

> An attestation is a formal assertion about the design or operation of controls — either a management certification or an independent practitioner's report such as a SOC report — relied on by a bank in lieu of, or alongside, its own testing of a third party.

- Source: https://ottoforfirms.com/glossary/attestation/
- Publisher: Otto — https://ottoforfirms.com
- Updated: 2026-07-26
- Status: in attorney review. Served noindex and excluded from the sitemap; do not cite as settled.

**In legal review — not indexed.** These definitions are drafted and readable, and stay out of search until an attorney has cleared each one.

[All terms](https://ottoforfirms.com/glossary/)

**Attestation** — An attestation is a formal assertion about the design or operation of controls — either a management certification or an independent practitioner's report such as a SOC report — relied on by a bank in lieu of, or alongside, its own testing of a third party.

The June 2023 interagency third-party guidance contemplates both forms: in due diligence a banking organization "may consider reviewing System and Organization Control (SOC) reports and any conformity assessment or certification by independent third parties," while also weighing whether the scope and results are actually relevant to the activity being performed. In contract negotiation it directs attention to what reports the bank is entitled to receive — "for example, SOC reports, Payment Card Industry (PCI) compliance reports, or other financial and operational reviews" — and to reserving audit rights. The SOC framework itself is an AICPA attestation standard, not a government one, which is why a bank cannot treat a SOC 2 as a substitute for compliance testing of FDCPA-specific controls; the two cover different populations.

## Primary sources

1. [Interagency Guidance on Third-Party Relationships: Risk Management, 88 Fed. Reg. 37920, 37932, 37937 (June 9, 2023)](https://www.govinfo.gov/content/pkg/FR-2023-06-09/pdf/2023-12340.pdf)

## See also

- [TPRM](https://ottoforfirms.com/glossary/tprm/)
- [Sampling](https://ottoforfirms.com/glossary/sampling/)
- [Examination](https://ottoforfirms.com/glossary/examination/)
- [Three-way reconciliation](https://ottoforfirms.com/glossary/three-way-reconciliation/)

## Where this appears

- [How banks audit their collection law firms](https://ottoforfirms.com/bank-audits/)
- [Client oversight — the bank window, which ships as Glass](https://ottoforfirms.com/platform/bank-window/)

---

This is an informational reference, not legal advice, and using it creates no attorney-client relationship. Limitations periods turn on facts this page cannot know — which state's law governs, the contract type, when the claim accrued, and whether anything tolled or revived it. Confirm against the primary source and your own counsel before acting.