SOC Reporting

If you are a service provider, the needs of your clients are changing and evolving as regulatory requirements grow more strict and complex. In addition to the services that you provide your clients, several may require that you demonstrate sufficient and effective control over their data and the systems that store their data. A System Organization Controls (SOC) report provides service organizations an opportunity to affirm the design and effectiveness of their internal control across all client information rather than addressing individual and specific questions or requirements. SOC reporting will provide your clients with confidence that you are processing and storing their information effectively, safely, and securely.

Why does a service organization want to perform SOC reporting?

To identify and manage risk better
To protect customer information and financial resources
To assist clients in their audit objectives
To satisfy customer contractual requirements
To stand out as a leader in your service industry

SOC 1 & SOC 2 Reports

SOC 1 Reporting

Prepared in accordance with Statement on Standards for Attestation Engagements (SSAE) No. 18, this type of SOC reporting is specifically intended to address your impact on your clients’ internal control over financial reporting. A SOC 1 examination allows you to demonstrate to your clients and their auditors that your internal control over their financial data is effective and in compliance with laws and regulations, such as Sarbanes-Oxley (SOX) 404.

SOC 2 Reporting

Prepared in accordance with AT-C 205, SOC 2 reports provide your clients information on your controls over security, availability, processing integrity, confidentiality and privacy (Trust Services Criteria). With this type of SOC reporting, you can assure your clients that their information is safe in your hands and that you are in compliance with service-level agreements and regulatory requirements, such as the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR).