What is SOC 2?
A SOC 2 audit assesses and reports on the internal control framework of a Service Organisation.
A SOC 2 audit report provides a service organisation’s management, user entities and other interested
parties (clients, customers) with assurance about the system and organisation controls the service
organisation has in place relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy
and enable such users to assess and address the risks that arise from their relationship with the Service
Organisation.
The SOC 2 audit report includes a detailed summary of the organisations system or service description
including an overview of the company, the boundaries and interfaces, the systems and services provided
and the system components.
The audit report also includes a management assertion or attestation provided by the Service
Organisations Senior Management, confirming that the system or service description and controls
identified are an accurate representation of the controls organisation actually has in place.
SOC 2 audits or SOC 2 reporting can only be performed by an independent CPA auditor or accountancy
organisation. SOC auditors are regulated by the AICPA and CPA auditors are bound by the AICPA code of
conduct. The auditor performs a SOC 2 audit or examination in accordance with the SSAE18 standard
sections AT-C 105 and AT-C 205.
The SOC 2 audit report is not intended for general distribution, given the level of detail within the report
and the sensitive and confidential nature of the information the report contains.
The AICPA Trust Services Criteria (TSC)
The AICPA Trust Services Criteria (TSC) is an independent, industry-recognised, third-party assurance
standard that is used to audit service organisations, such as Cloud service and hosting providers, SasS
software providers and developers, web marketing companies and financial services organisations.
The AICPA TSC’s selected have to adequately address the risks to the system or service that the service
organisation is providing to their clients.
There are 5 TSC categories Security, Availability, Processing Integrity and Privacy. These are split further
across the 5 categories into 27 TSC criteria and 300+ points of focus. The points of focus provide details
as to the features that should be included in the design, implementation, and operation of the control
related to the particular criterion.
The 5 TSC categories are defined below:
1. Security or Common Criteria
Information & systems are protected against unauthorized access, disclosure of information and
damage to systems that could compromise the entity’s ability to achieve objectives.
2. Availability
Accessibility of information used by the entity’s systems as well as the products or services provided to
its customers.
3. Processing integrity
Information completeness, validity, accuracy, timeliness, and authorization of system processing.
4. Confidentiality
Ability to protect information designated as confidential from its collection or creation through its final
disposition and removal from the entity’s control
5. Privacy
Personal information is collected, used, retained, disclosed and disposed [of] to meet the entity’s
objectives.
SOC 2 Type 1 vs Type 2
SOC 2 Type 1
SOC 2 Type 1 service auditor reports on the fairness of the presentation of management’s description of
the service organization’s system and the design effectiveness of the controls. The organisation has built
in controls to manage and process information in manner that will ensure that the user organization
does not have material misstatement.
SOC 2 Type 2
SOC 2 Type 2 service auditor reports on the fairness of the presentation of management’s description of
the service organization’s system, opinion on the design effectiveness of the controls and on the
operating effectiveness of these controls
Audit Report Structure
Part 1- Independent auditors report
Part 2- Management Assertion
Part 3- System Description
Part 4- Testing Results
Our Services
SOC 2 GAP Assessment
SOC 2 GAP Assessment process is designed to detect any holes that could lead to a finding during the
AICPA SOC 2 audit. The assessment is designed to document any control concerns, and get you on a fast
path to resolution prior to the start of the audit period. Whether you are undergoing a SOC 2 Type I
audit or a SOC 2 Type II audit, we can assist you with prioritizing controls.
SOC 2 Consulting
SOC 2 audit collection process can take a considerable amount of time for your team. We can assist you
with implementation, documentation of controls. Our implementation help in meeting audit
expectations and requirements. This ensures a smooth process from start to finish.
SOC 2 Audit
SOC 2 audit requirements for end to end audit can be fulfilled and reported based on the SSAE 18
requirement. Our extensive experience in dealing with SaaS, Outsourcing, IT services and product
companies to meet the right reporting requirements.
|