In recent years, there has been greater focus on internal controls by regulators, board of directors and others charged with governance, creating an increased demand for attestation report over financial reporting and other matters. As a result, the American Institute of CPAs (AICPA) developed a framework- (SOC) System and Organization Controls formerly, Service Organization Controls that involves examination which reports on the controls at a Service Organization.
SSAE 18/ SOC Audit
The SSAE 18 stands for Statement on Standards for Attestation Engagements under which the SOC report is produced, or more specifically, SOC 1, SOC 2 or SOC 3.
Service Organization Control (SOC) reports are internal control audit reports issued by a CPA on the services provided by a service organization that performs specific outsourced services to a third party user entity.
SOC 2 Compliance report is designed to help service organizations, entities that process information or handle business transactions on behalf of its customers, build trust and confidence in their service delivery and controls over information and data through a report prepared by a CPA.
On the other hand, SOC report provides valuable information that users need to assess and address the risks associated with an outsourced service. These reports may be required by a service organization’s auditors, their third party user’s auditors, or by a key vendor or customer.
Types of SOC Services
A SOC 1 report results from an engagement under a Statement on Standards for Attestation Engagements, formerly known as SSAE 16 – Reporting on Controls at a Service Organization. This examines internal controls at a service organization that impact a user entity’s internal control over financial reporting. This report is to be used only by auditors of user organizations and the management of user entities. The auditors of the service organization’s customers can use the SOC 1 Type 1 & 2 report to gain an understanding of the internal controls of the organization. This allows for analysis and assessment of internal control risk for the purposes of planning and executing a comprehensive financial audit.
SOC 2 reports provide detail on controls at a service organization covering security, availability, processing integrity, confidentiality or privacy. Its use is generally restricted to certain identified users who, among other things, have some knowledge of the nature of the services that the service organization provides. The SOC 2 Type 1 & 2 report can offer greater assurance to customers and stakeholders about internal controls in areas that were not meant to be covered by a SAS 70 report.
SOC 2 + Additional Subject Matter - a service organization may request that the SOC report address additional subject matter that is not specifically covered by the trust services principles and criteria.
SOC 3 reports are Trust Service examination reports. They address the same subject areas as a SOC 2 report, but, it is less detailed and less technical and might not contain the same level of vital intricacies of the business. It is a shortened version that can be used in a service organization’s promotional efforts and on its website. SOC 3 reports can serve as a marketing tool, with potential customers, for instance, to show the organization has appropriate controls in place to mitigate risks on non-financial subject matters. The SOC 3 option is considerably more open than the SOC 1 and SOC 2 in that it has no restricted usage (General use report). Anyone can use this document.
SOC for Supply Chain is a risk management and reporting framework designed specifically for producers, manufacturers, and distributors. Part of the AICPA SOC Suite of Services, it allows organizations to evaluate their internal controls as they relate to their supply chain. A SOC for Supply Chain compliance assessment allows organizations to identify, evaluate, and mitigate risks that could disrupt their operations. The corresponding report also allows organizations to provide prospective customers with relevant information about their production, manufacturing, or distribution system.
The increasing number of cyber threats has led the American Institute of Certified Public Accountants (AICPA) to issue the Cyber security Risk Management Reporting Framework, also known as the System and Organization Controls (SOC) for Cyber security. A SOC for Cyber security report is a general use report, and is ideal for businesses, non-profits, and virtually any other type of organization that wants to take a proactive approach to risk management.
Our Services
The Attinkom Team has generated a number of SOC reports for clients in a variety of industries.
We tailor our SOC services to ensure that service organizations receive the highest level of assurance over the effectiveness of their internal controls, and work with clients to determine which type of SOC report is best suited for your organization's needs.
Attinkom SOC Advantage: Onsite Assessment by CPA
SOC Readiness
Many organizations know they need to begin the SOC process, but don’t know how to get the ball rolling. This is where our “SOC Readiness” services come into play.
To kick off the process, our team first becomes familiar with your organization and the control environment that you already have in place. The SOC readiness assessment phase allows us to work closely with you to prepare you for actual execution of your SOC Report – whichever report may be applicable for your organization and its needs. This phase allows us to get to know your operation on various levels before you embark on the actual report. This is always a good starting point that allows us to position your control environment for the best possible outcome once the review period of your actual SOC Report begins.
SOC Attestation (Type I and II)
Attinkom is here to help your organization exit the SOC process with a stellar SOC report that will communicate to those you partner with that your control environment is sound. We also want your SOC report to open the door for you for new partnerships and investment partners.
SOC & ISAE Combined report
The performance of SOC examinations and preparation of the corresponding reports are governed by the American Institute of Certified Accountants (AICPA) Attestation Standards. The IAASB uses ISAE 3000 and ISAE 3402 to govern international examinations. Yes, the two be combined into one audit and documented in one report. according to AICPA guidance, you can have a single examination that covers both the AICPA and IAASB standards.
The right comparisons between the both is:
- A SOC 1 examination may be performed in accordance with ISAE 3402; and
- A SOC 2 assessment may be performed in accordance with ISAE 3000