System & Organization Controls (SOC) Reporting

Not only do SOC reports offer a valuable assessment of a service organization’s ability to mitigate risk and deliver effective services, they provide assurance to potential customers, communicating that the internal controls at your organization are designed and operating effectively.

If your company has not been asked to furnish a SOC report as part of vendor diligence or contract negotiation, it is likely just a matter of time. KSM’s experienced and knowledgeable advisors can help you facilitate all aspects of the SOC reporting process.

Services Provided

Readiness Assessments

No one likes surprises when it comes to compliance, and readiness is the key to avoiding them. Our skilled advisors are able to provide personalized readiness assessments prior to a SOC engagement to help identify any deficiencies in business policies, procedures, and control environments. Additionally, by taking into account an organization’s unique business environment, we can identify key control issues and tailor solutions and best practices to fit a company’s specific needs.

---

SOC 1

A SOC 1 is a report on controls at a service organization relevant to user entities’ internal controls over financial reporting. This report is specifically intended to meet the needs of entities that use service organizations (user entities) and the CPAs that audit the user entities’ financial statements (user auditors), in evaluating the effect of the controls at the service organization on the user entities’ financial statements.

A SOC 1 has two types of reporting options — Type 1 and Type 2*. Distribution of these reports is restricted to management of the service organization, user entities, and user auditors.

---

SOC 2

A SOC 2 report is intended to meet the needs of a broad range of users that need detailed information and assurance about the controls at a service organization relevant to security, availability, and processing integrity of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems.

These reports can play an important role in:

• Oversight of the organization
• Vendor management programs
• Internal corporate governance and risk management processes
• Regulatory oversight

Like the SOC 1 report, the SOC 2 includes both a Type 1 and Type 2* option and distribution is restricted to management of the service organization, user entities, and user auditors.

---

SOC 3

A SOC 3 report is designed to meet the needs of users who need assurance about the controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy, but do not have the need for or the knowledge necessary to make effective use of a SOC 2 Report. The service organization may engage the service auditor to issue two reports at the end of the examination: a SOC 2 report to meet the governance needs of its existing customers and a SOC 3 report to meet more general user needs.

Key differences between a SOC 2 and a SOC 3:

• In a SOC 3, a complete description of systems and the description of the service auditor’s tests of controls and the results thereof are not included.
• In a SOC 3, the report is general use (unrestricted) and more appropriate for general marketing purposes.

---

SOC for Cybersecurity

A SOC for Cybersecurity report provides assurance over an organization’s entity-wide cybersecurity risk management program. This report helps reduce uncertainty and build resilient organizations by evaluating the effectiveness of existing cybersecurity processes and controls. Similar to a SOC 3, this is a general use report (unrestricted) and does not include a description of the service auditor’s tests of controls and the results thereof.

---

SOC for Supply Chain

A SOC for Supply Chain is a market-driven, flexible, and voluntary reporting framework that includes a Description Criteria and Trust Services Criteria (similar to a SOC 2). CPAs, management accountants, and organization management can use this tool to communicate about the organization’s supply chain risk management efforts and assess the effectiveness of system controls that mitigate those risks.

*Type 1 and Type 2 Reports

SOC 1 and SOC 2 reports may come in two different types, depending upon whether the performance of the controls is tested and whether the report is intended to cover a period of time or a single point in time.

• A Type 1 report includes an opinion covering the suitability of the design of the controls as of a specified date.
• A Type 2 report includes an opinion covering the design and operating effectiveness of controls throughout a specified period.