System and organization controls (SOC) reports
To mitigate these risks, organizations conduct thorough evaluations of their service providers – often by reviewing SOC reports. These reports confirm a service provider’s ability to meet its commitments. If your organization provides services to other businesses, obtaining a SOC report is essential to demonstrate trust, transparency and compliance.
We help navigate your SOC report options.
SOC Readiness and Gap Assessments
It’s important to prepare before undergoing a SOC audit for the first time. We work with your organization to adequately define the scope of the report and identify key controls that meet applicable criteria and use cases, demonstrate trust with your customers, and align with industry best practices.
A readiness assessment is typically the first step in preparing for a successful SOC audit. Our dedicated professionals assist with scoping, identifying and documenting relevant controls, evaluating preparedness, and finding gaps or weaknesses that may impact the audit process. The proper scoping and alignment of expectations will ensure a cost-effective, efficient approach to the audit.
SOC 1®
The SOC 1® examination is focused on controls related to financial statement reporting. Companies that have outsourced critical functions that impact their financial reporting must assess controls over these functions the same way they do in-house functions. The SOC 1® report fulfills the needs of your customers and the accountants that audit their financial statements. SOC 1 is commonly used by service organizations, such as payroll providers and third-party beneficiaries.
SOC 2®/SOC 2+
he SOC 2® report addresses controls other than those relevant to financial reporting. This audit focuses on controls relevant to the Trust Services Criteria. The TSC include Security, Availability, Processing Integrity, Confidentiality and Privacy. Organizations that wish to incorporate additional criteria, such as HIPAA, PCI or NIST Cybersecurity Framework, can do so through SOC 2+ reporting. This is a restricted-use report intended for management, customers and their auditors.
SOC 3®
The SOC 3® report covers everything in a SOC 2® report while providing a simple, publicly available report as the final deliverable.
SOC for Cybersecurity
SOC for Cybersecurity reports provide relevant information about the effectiveness of an organization’s cybersecurity risk management program. This report may be more useful for an organization that needs to demonstrate the effectiveness of their cybersecurity program to internal or external stakeholders.
