SOC Reporting

Furthermore, the creation of System and Organization Control Reports (SOC 1, SOC 2, SOC 3 reports) provide three new reporting vehicles developed for service organizations to respond to demands for uniform reporting and review—expanding service organizations’ ability to report on financial controls, non-financial controls and, with SOC 3, become certified trusted system service organizations.

CPAs perform SSAE 18 attestments to provide assurance to the service organization’s customers and their auditors that the organization has certain, adequate and effective controls in place.

• Type I audits consider the controls’ design effectiveness at a certain point in time
• Type II audits examine the controls’ design and operating effectiveness over a specific period, typically six to 12 months.

SOC 1, SOC 2 and SOC 3 engagements address today’s environment that:

• Requires greater international consistency
• Addresses newer technologies such as cloud computing, mobile, and virtualization
• Demands more widely recognized and understood reporting options

LBMC Information Security’s audit professionals operate as part of LBMC, PC—a Top 50 US CPA firm. We provide SOC services to clients across the country and maintain appropriate licensure in the states in which we provide attest work. As a result, we have in-depth industry knowledge to help service providers in a variety of industries, including healthcare and claims processing, financial services, cloud service providers, and commercial collation and hosting providers.

SOC 1 requires management to provide written descriptions of its systems and assert that the system descriptions are fairly presented, control objectives suitably designed and operate effectively, and identify the criteria they used to make those assertions.

While SOC 1 examines service organizations’ controls related to financial reporting, SOC 2 and SOC 3 reviews security, availability, processing integrity, confidentiality, and privacy reporting controls that align to the AICPA Trust Services Criteria (TSC).

SOC 2 engagements use the TSC as well as the requirements and guidance in AT Section 101, attest engagements, of SSAEs (AICPA, professional standards, vol. 1). A SOC 2 report is similar to a SOC 1 report. Either a type 1 or type 2 report may be issued and the report provides a description of the service organization’s system. For a type 2 report, it also includes a description of the tests performed by the service auditor and the results of those tests.

View Service Flyer (PDF)

SOC 3 engagements use the predefined criteria in trust services criteria that are used in SOC 2 engagements. A SOC 3 report is a general-use report that provides only the auditor’s report on whether the system achieved the trust services criteria (no description of tests and results). It also permits the service organization to use the SOC 3 seal on its website. SOC 3 reports can be issued on one or multiple Trust Services Criteria (security, availability, processing integrity, confidentiality, and privacy).

The SOC for Cybersecurity examination is designed to provide report users with information to help them understand management’s process for handling enterprise-wide cyber risks. It can be performed for any type of organization regardless of size or industry, and report users aren’t necessarily current customers or customer auditors.

SOC for Cybersecurity provides the following:

• A standard, consistent, way to report on an entity’s cybersecurity risk management program (CRMP).
• An effective way to communicate cybersecurity control effectiveness to stakeholders, boards, committees, customers, and partners through a comprehensive cybersecurity audit.

Differing from SOC 2 reports, SOC for Cybersecurity reports address the following:

• The baseline against which an entity is assessed in SOC for Cybersecurity is the Description Criteria for management’s description of the entity’s cybersecurity risk management program.
• An organization pursuing a SOC for Cybersecurity may utilize the Trust Services Criteria, but may also use another generally accepted security framework when designing or assessing its control requirements.
• SOC for Cybersecurity reports are general use reports, and the objectives of the report are often determined by company management. These reports are meant for a broader audience than SOC 2 reports and may be shared with anyone inside or outside an organization.
• In a SOC for Cybersecurity, the controls matrix will not be included in the report.

The LBMC Information Security team was instrumental in working with the AICPA to create and release this assessment to help you achieve compliance and provide the insights you need to make better business decisions.

View Service Flyer (PDF)