Soc 1 Signature Service Made Easy

Soc 1 signature service

[Music] [Applause] hi this is my corner with McConnell Ian Astbury I'm the partner in charge of our service organization controls practice and over the last 12 to 18 months we've received a significant number of inquiries into new SOC reports and it's it's highlighted the need for further education in this area so thanks for joining us for a few minutes our purpose today is not to go into significant detail but just to do a a high-level 30,000 foot overview of who gets sauk reports why they're asked for and what the various types of SOC reports mean it's helpful to start with a little bit of history on the SOC reports if you go back to 1992 service organizations were given the option of performing a SAS 70 report that's a very familiar name to a lot of us and the SAS 70 report was really geared towards helping service organizations provide an opinion on the effectiveness of their internal controls to those customers and users that use the services they provided over the course of a number of years the purpose of the SAS 70 stayed the same that the service organizations changed we had things like data centers and software as a service providers we had infrastructure management things that really didn't get covered by the SAS 70 approach but were significant service providers to use her customers to address some of these changes that were necessary and make sure those service organizations could report to their user customers sSAE 16 was released in 2010 the purpose of sSAE 16 was to make sure we had a clear understanding of how service organizations that do traditional transaction processing could report to their users but also to address the needs of the information technology based service organizations this introduced the idea to us of SOC 1 SOC 2 and SOC 3 reports which is really the purpose of the next few minutes we'll talk about what those are what they mean and who gets them first let's cover the basics who gets an SOC report SOC reports are geared towards service organizations that's defined as an entity that provides services to customers that are important to that customers control systems so you can provide services that effect financial reporting like transaction processing or you can be a data center that provides all the back office data processing for that organization so service organizations exactly what it sounds like it's an entity that provides services to others and the SOC report again is really meant to speak towards the internal controls at that user organization and how that affects their customers so by providing that SOC report to their customers the customer is assured that the organization has good controls in place over the things that are important to them and therefore they can provide that report to their auditor and their management and their stakeholders to ensure that they do have a good adequate understanding of all the internal controls not only within the organization but at those service providers they rely on to conduct their business so to talk a little bit about sock one report specifically let me introduce my colleague Josh bants josh is a great part of our practice here makan lean as Berrien has a lot of experience in both sock one and two and he'll take just a few minutes to talk through who gets a sock one report and what specifically that means hi I'm Josh bansa senior manager in McAllen asbury in the service organization of controls practice sock one examinations focus on controls at service organizations that are relevant to internal controls over financial reporting at the user organizations a perfect example of this would be a payroll processor who processes payroll and then provides reports to user organizations for them to record the financial transactions some key components to a sock Wan report service organizations get the opportunity to select and scope their control objectives and controls at a service or the service organization controllers one report the service organization management will actually perform a risk assessment which goes over the risks associated with the controls that they perform and determine the appropriate control objectives and controls relevant to those those services sock one reports have several key components one is the auditor's report which includes an opinion on the internal controls in addition to that there's a description of controls narrative which details all aspects of the service organization could the service organizations controls in addition there's also a section of the report that includes the controls as well as the control objectives and the tests of the controls the last one of the last components of the report is a user control consideration section which details how the service organization determined the appropriate scope for the controls based upon the user control considerations that the user entities such as logical access controls things like that that would impact aspects of the controls of the service organization in addition to the control objectives and controls within the report there's also a section on user entity control considerations which are the controls that must be in place at the user entity for the controls of the service organization to work appropriately there are two types of sauk one examination the type 1 examination is an examination on the design effectiveness of the controls at a service organization the primary focus of this is on walkthroughs and inquiry to determine whether the controls are designed effectively to meet the appropriate control objectives we rarely get the opportunity to do these as they provide very very limited assurance to a service organization so where Sauk 1 reports are really focused on service organizations that provide services directly impacting financial reporting Sauk 2 examinations are focused on those organizations that provide other administrative services or support services like data hosting software as a service providers things that are more operational in nature than directly impacting financial reporting so there's some significant differences in the Sauk reporting the nature of the report but most importantly the control objectives and the things that need addressed in the report so we're in a stock one the service organization identifies those objectives most relevant to its users and reports on the controls that manage those objectives a sock to report has to be geared towards the as CPAs trust Services principles which are security availability processing integrity confidentiality and privacy now a sock - doesn't have to address all five of those it can address anywhere from one to five but it's not something that the user organization or the the service organization can define this is the objectives I want to meet it must be one of those five areas and it must cover the criteria that are addressed in each of those five areas going into detail on what those are and what those mean is well beyond the scope of what we can get through today but certainly worth a conversation if you're a service organization that provides that operational type of of data hosting or backup so reach out to us if you have questions on that and we'll get into that in more detail on a one-to-one basis so the nature of a sock to report and if you look at a sock one versus a sock to report you'll see that the structure is very similar so you have the service auditors opinion where McCauley and Asbury provides our opinion on the effectiveness of all the controls if it's a type 2 then you'll have management's narrative that walks through all the processes surrounding the service organization and then ultimately will be that similar section to Josh talked about where we talked about control objectives and how they're managed there's a lengthy section on the trust Services principles and how those criteria are managed and what controls are in place and what the findings were of our testing no different than a sock one you can also have a type one and a type two report and important to just reiterate that there are five trust service principles the service organization identifies which one two three four or five are most relevant to their customers and only focuses on the ones they've selected the tape to examination includes additional assurance and includes tests of controls to ensure that they are working and operating effectively the tape to examination is generally over a period of time with a period not less than six months and up to a year to 18 months we generally do the majority of our work during type 2 examinations as they provide the appropriate assurance on the not only design but also the operating effectiveness of the controls sock three examinations are very similar to stop two in that their examination on the the design and operating effectiveness of controls relevant to the trust Services principles it's the primary difference between a sock two and a sock three is that a sock three report includes only an auditors opinion as well as a very very limited narrative of the controls and a design of the system in addition the sock three report is a general use report which allows it to be widely distributed to potential clients as well as to be posted to the service organization's website if Mia we recognize this was an extremely high level review of sock reporting and the differences in sock one sock two sock three we talked about type 1 and type 2 we talked about service providers that provide financial reporting and data we're housing and very very high level and so we invite you to reach out to us and please if you have further questions if you represent a service organization or if you represent a user organization and wonders what you're getting in a service organization controls report please reach out Joshua I will be more than happy to talk through your needs and give you some clarity on what you're looking at Thanks have a wonderful day [Music] [Applause] [Music]