SOC Reporting and COVID 19
COVID-19, the most buzzed word these days, a virus that has not only impacted health of the humans but has also affected
With a lot of experience in audit, hiring us will become a right solution for your business!
Domain | Trust Services Principle | Applicability |
---|---|---|
Security | Under this Trust service principle, the SOC scoped IT system and Business services are protected against unauthorized access that addresses physical and logical both ways of access. |
|
Availability | This trust service principle ensure that the IT and Business system should be available for operation and provide services as committed or agreed with the client and respected stake holders. |
|
Confidentiality | This trust service principle addresses that the Information which are designated as confidential should be protected adequately as committed or agreed by the stakeholders. |
|
Processing Integrity | This trust service principle addresses that the System processing is complete, accurate, timely and authorized. |
|
Privacy | This trust service principle ensures that the Personal information is adequately collected, stored, used, disclosed and purged in compliance with the commitments as per the user entity’s privacy notice and by setting up a criterion set forth in normally accepted privacy principles in accordance with AICPA. |
|
Audit Preparation | Audit |
---|---|
Define audit scope, and overall project time line | Provide overall project plan |
Identify existing or required controls through discussions with management, and review of available documentation | Complete advance data collection before on-site work to accelerate the audit process |
Perform readiness review to identify gaps requiring management attention | Conduct on-site meetings, and testing |
Communicate prioritized recommendations to address any identified gaps | Complete off-site analysis of collected information |
Hold working sessions to discuss alternatives, and remediation plans | Conduct weekly reporting of project status, and any identified issues |
Verify that gaps have been closed before beginning the formal audit phase | Provide a draft report for management review, and electronic, and hard copies of the final report |
Determine the most effective audit, and reporting approach to address the service provider’s external requirements | Provide an internal report for management containing any overall observations, and recommendations for consideration |
A SOC 2 Type 1 audit is an audit report containing procedures and controls prepared at a particular point of time. It is generally the design of controls report which evaluates the design on controls put into operations at a point of time. A SOC 2 Type 2 audit reports audits the operating effectiveness of the controls throughout a declared time period, between 6 months and one year. It provides the highest level of assurance to all customers and clients.
SOC 2 preparation usually happens in a few stages. First, your company should identify all “key systems” and perform a gap analysis against all requirements documented in the Trust Services Principles and Criteria. Next, existing security controls should be identified and policies and procedures should be written to meet all requirements. This can take anywhere from a few weeks to up to 6 months, depending on the size and maturity of your company. At this point you are ready for the SOC 1 Type I audit. A SOC 2 Type II audit is typically performed 6 months later.
Traditional SAS 70 | SOC 1 | SOC 2 | SOC 3 |
---|---|---|---|
Auditor’s Opinion | Auditor’s Opinion | Auditor’s Opinion | Auditor’s Opinion |
- | Auditor’s Opinion | Management Assertion | Management Assertion |
Assertion System Description (including controls) | System Description (including controls) | System Description (including controls) | System Description (including controls) |
Control objectives | Control objectives | Criteria | Criteria (referenced) |
Control activities | Control activities | Control activities | - |
Tests of operating effectiveness | Tests of operating effectiveness | Tests of operating effectiveness | - |
Results of tests | Results of tests | Results of tests | - |
Other Information (if applicable) | Other Information (if applicable) | Other Information (if applicable) | - |
There are several requests made by clients to service organisations to share the details of their internal policies and controls.In between these requests, they also receive requests related to audit the service organization. Sharing a single,Comprehensive control report to their clients will help service organizations in :-
Organizations, when scrutinized by their regulators are asked to showcase the evidence on how they manage the risks and controls which are related to Third Party service providers. Let’s take an example of a third party management which was subjected to Financial Services Authority’s recent “Dear CEO” letter. As far our experience is concerned, SOC Report is the most demanded requirement due to its diligence process.
SOC Report focuses on the details of the services provided along with policies, procedures and controls that service organization has in place. Demands for SOC Report within firms are increasing rapidly which adds a competitive advantage having independent assurance over their systems.
SOC Report is asked by the parent company as an evidence to check whether control environment is in place or not. Types of report – Type1 and Type2 is specified when the client requests it.
In recent years regulators have transitioned toward control reporting standards that are more specific to the service offering provided by the service organization.
Click on the link below to for a FREE Download the latest version of the AICPA Trust Services Criteria.
This Stream includes all of our Case Studies Flipbooks
This query has been heard many times by different organization that -What is SOC 1 report?
ABC Ltd provides hosted platforms services using secure and reliable cloud technologies...
Accorp performed SOC 1 and SOC 2 audit for Simplain Software Solutions LLC. This was the 1st time that simplain was going for a SOC audit and hence they wanted us to perform readiness assessment for the control environment. While performing the readiness assessment, some of the gaps in Simplain’s Information security policies and procedures were identified and few recommendations were given to improve the IT processes for domains like incident management, service request management, etc.
Applicable Standards | ||
---|---|---|
Canadian Only | SOC 1 | CSAE 3000 and CSAE 3416 |
SOC 2/3 | CSAE 3000 | |
SOC For Cyber | ||
Canadian and U.S. | SOC 1 | Canadian: CSAE 3416 and CSAE 3000 |
SOC 2/3 | U.S.: AT-C Section 105,205 and 320 Canadian : CSAE 3000 |
|
SOC for cyber | U.S.: AT-C Section 105 and 205 | |
Canadian and International | SOC 1 | Canadian: CSAE 3416 and CSAE 3000 International : ISAE 3000 and ISE 3402 |
SOC 2/3 | Canadian : CSAE 3000 | |
SOC for cyber | International : ISAE 3000 | |
Canadian, U.S. and International | SOC 1 | Canadian : CSAE 3000 and CSAE 3416 U.S. : AT-c Sections 105, 205 and 320 International : ISAE 3000 and ISAE 3402/td> |
SOC 2/3 | Canadian: CSAE 3000 U.S.: AT-C Sections 105 and 205 International: ISAE 3000 |
|
SOC for cyber |
Our years of experience across industries runs deep while we maintain a constant lookout for what's next. See what we deliver in your sector.