SOC Compliance Specialists

SOC 1  
Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting

These reports are specifically intended to meet the needs of the managements of user entities and the user entities’ auditors, as they evaluate the effect of the controls at the service organization on the user entities’ financial statement assertions.
These reports are important components of user entities’ evaluation of their internal controls over financial reporting for purposes of comply with laws and regulations as they plan and perform audits of the user entities’ financial statements.   There are two types of reports for these engagements:

  • Type 1 – A report on management's description of the service organization's system and the suitability of the design of the controls to achieve the related control objectives included in the description as of a specified date.
  • Type 2 -  A report on management's description of the service organization's system and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives included in the description throughout a specified period.

SOC 2 
Report on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy
These reports are intended to meet the needs of a broad range of users that need to understand internal control at a service organization as it relates to security, availability, processing integrity, confidentiality and privacy.
These reports are intended for use by stakeholders,e.g., customers, regulators, business partners, suppliers and directors of the service organization. These reports can form an important part for users to:

  • Oversight of the organization
  • Vendor management program
  • Internal corporate governance and risk management processes
  • Regulatory oversight

Similar to  SOC 1  there are two types of report : Type 2, report on management’s description of a service organization’s system and the suitability of the design and operating effectiveness of controls; and Type 1, report on management’s description of a service organization’s system and the suitability of the design of controls. 

SOC 3 
Services Report for Service Organizations
These reports are designed to meet the needs of users who want assurance on the controls at a service organization related to security, availability, processing integrity, confidentiality, or privacy but do not have the need for or the knowledge necessary to make effective use of a SOC 2 Report. SOC 3 Reports can be freely distributed or posted on a website as a seal. 
Our approach ensures:

  • Comprehensive risk assessment
  • Testing is completed with minimal interruption to the organization
  • Proper documentation of control processes and procedures
  • Identification of control weaknesses
  • Recommendations for improvements and value addition
  • Avoidance of surprises after completion of SOC testing