• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
Anatomy of Service Organization Control (SOC) Reports - July 2011
 

Anatomy of Service Organization Control (SOC) Reports - July 2011

on

  • 858 views

Following the recent release of final guidance from the American Institute of Certified Public Accountants (AICPA) on the new Service Organization Control (SOC) reporting options—and the retiring of ...

Following the recent release of final guidance from the American Institute of Certified Public Accountants (AICPA) on the new Service Organization Control (SOC) reporting options—and the retiring of the SAS 70 standard as of June 15, 2011—we thought this would be an appropriate time to answer the question many financial, technical and marketing executives have been asking: What does a SOC report look like?

Statistics

Views

Total Views
858
Views on SlideShare
858
Embed Views
0

Actions

Likes
1
Downloads
0
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment
  • I’d like to now introduce our speakers for this afternoon – our resident SAS 70 and SOC experts - Rob Busch,Michelle Mackey and Matt Pettine. Their respective backgrounds and areas of expertise ensure our clients get a well-rounded perspective and result in engagement deliverables that allow our clients to confidently demonstrate that their infrastructure, applications and processes are appropriately designed and operating effectively, which in turn paves the way for them to build trust with their customers.Our first speaker, Rob Bush, is an Audit Partner here at MFA. Rob has over fifteen years of experience in audit, reviews, and compilations. He works closely with clients on a variety of technical and business issues including revenue recognition, stock-based compensation, equity transactions, business combinations , SAS 70 and SOC audits and surprise examinations for registered investment advisors. He has extensive experience in Sarbanes-Oxley compliance consulting, SEC reporting, and performing financial statement audits for companies in the construction, high tech, service, manufacturing, and distribution industries.Our second speaker for this afternoon is Michelle Mackey. Michelle is a Director for MFA’s affiliate company, MFA Cornerstone Consulting, and plays an instrumental role in helping the firm's clients optimize performance, control risk and adhere to regulatory compliance.  Michelle is sought after by clients for her expertise, particularly in the area of business process efficiency, SAS 70 and Sarbanes-Oxley compliance.  In addition, as a Certified Fraud Examiner, Michelle works closely with clients to identify areas of fraud susceptibility within their current systems, procedures and transactions.   Our third and final speaker this afternoon is Matt Pettine. Matt is the Managing Director of the IT Advisory Practice for MFA’s affiliate company, MFA Cornerstone Consulting. In his role Matt provides:-technical and managerial consulting -business risk assessment-customized application development -and infrastructure solutions.  Matt assists clients in all aspects of MIS infrastructure and IT support, including -design, -planning, -system controls, -and hands-on implementation, testing and maintenance.So without further ado, I’d like to turn the floor over to Rob.
  • Thank you Michelle,Rob and Matt. We’d now like to address some of the questions sent to us during the presentation.Our first question is…
  • OK, that’s all the time we have for questions today. If we did not get to your question, we’ve made a note of it and will be sure to follow-up with you individually.Before we sign off, do any of the presenters have any final thoughts you want to leave the audience with?I’d like to thank all of you for joining us today. If you’d like to further discuss the new SOC reporting options and their applicability to your organization, please feel free to contact Rob, Michelle or Matt at the phone numbers or email addresses on the screen. And as a final reminder, we will be following up and sending all of you a link to access today’s presentation.Again, thank you for your time today.

Anatomy of Service Organization Control (SOC) Reports - July 2011 Anatomy of Service Organization Control (SOC) Reports - July 2011 Presentation Transcript

  • Anatomy of a SOC Report
    Thursday, June 23, 2011 (1:00 pm – 2:00 pm)
  • Seminar Logistics
    All attendees are muted during the presentation
    – We cannot hear you
    Audio difficulties
    Hang up and redial (805) 309-0022
    Enter access code 653-581-897
    Enter the Audio Pin displayed on your Attendee Control Panel
    We will take questions at end of presentation
    During the presentation you may type questions into the Question Screen on your Attendee Control Panel – click Send Privately
    CPE credit
    Copy of today’s presentation
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • About MFA
    Proactive CPA and consulting firm with national and global reach
    Offer a wide range of professional advisory services
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    • Corporate Governance / Compliance Consulting
    • Performance & Controls Consulting
    • Fraud & Forensic Accounting
    • Litigation Support
    • IT Advisory
    • Professional Staffing
    • Audit & Assurance
    • Taxation
    • Valuation
    • M&A Transaction Services
    • Specialty GAAP Advisory
    • Wealth Advisory
    • Retirement Plan Advisory
  • Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    Presenters
    Robert A. BuschCPAPartner
    Michelle A. MackeyCFE, MBADirector
    Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Director
  • Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    Agenda
    Attestation versus Auditing Standard
    SOC 1 versus SOC 2 or 3 – which report do I need?
    SOC 1 Report versus a SAS 70 Report
    SOC 2 Report
    SOC 3 Report
    Anatomy of a SOC Report
    Questions
  • Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    Attestation versus Auditing Standard
  • Attestation versus Auditing Standard
    SAS 70 – Audit Standard
    In the past, the SAS 70 report was intended to assist service organizations’ customers and their auditors in the context of a financial statement audit.
    SSAE 16 – Attestation Standard (effective June 15, 2011)
    Traditional SAS 70 reports are being replaced by Service Organization Control Reports (or “SOC” reports)
    Now, three SOC reports have been defined to replace SAS 70 and help service organizations meet a broader set of specific user needs – including addressing security, privacy and availability.
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Reason for the change
    Need for greater international consistency (ISAE 3402)
    New Technologies (SaaS, cloud computing, privacy concerns for emerging technologies)
    Clarity of purpose (misunderstandings, misapplications, misuses of the former SAS 70 report)
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    Which Report do I need?
  • SOC 1 versus SOC 2 or 3 – which report do I need?
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SOC 1
    Former SAS 70 Reports – New SSAE 16 guidance
    Focuses on internal controls over the user organizations’ financial reporting
    Includes details about the systems and processes of the service organization
    Auditor to Auditor Report
    Restricted Use Report
    SOC 2
    Primary interest around compliance and operational controls
    Includes details about the systems and processes of the service organization
    Trust Criteria: 1) Security, 2) Availability, 3) Processing Integrity, 4) Confidentiality, and 5) Privacy
    Restricted Use Report
    SOC 3
    Primary interest around compliance and operational controls
    Similar to SOC 2 Report, but does not provide specific service organization company details
    Same work completed as the SOC 2 report
    General Use Report
    Seal can be placed on the service organization’s web site
  • SOC 1 versus SOC 2 or 3 – which report do I need?
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Management assertion now within the report
    Opinion on the design of the controls
    Type I Report – design and the presentation of controls are still a point in time (“as of date”)
    Type II Report – opinion on the design of the controls and their operating effectiveness over the reporting period (“period of time”)
    Service organization still documents their control environment
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SOC 1 Report versus a SAS 70 Report
  • Trust Criteria versus User Organization Defined Objectives
    Five Principals
    Security
    Availability
    Processing Integrity
    Confidentiality
    Privacy
    Service Organization selects which principal they would like to report on
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SOC 2 Report
  • SOC 3 Report
    Most similar to SOC2, including the use of Trust Principles
    Reports itself omits specific detail regarding control testing
    Only General Use report – can be shared with prospects
    May have only limited value to user organization auditors
    Optional SOC3 seal available for the website
    Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    Anatomy of a SOC Report
  • Anatomy of a SOC Report
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Anatomy of a SOC Report
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SECTION 1: Auditor’s Opinion
    The “opinion” by the service auditor
    Description of controls is fairly stated (no omissions or distortions)
    Controls were suitably designed to achieve the stated control objective
    Controls are effectively designed (Type I)
    Controls were operating effectively (Type II)
  • Anatomy of a SOC Report (Continued)
    SECTION 2: Management Assertion
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Anatomy of a SOC Report (Continued)
    SECTION 2: Management Assertion (Continued)
    Management has determined the control objectives and control activities are reflected within the report
    Management believes the description of the controls are fairly presented
    Controls are suitably designed to achieve control objectives
    Management is not aware of any illegal acts, fraud, or uncorrected errors by management employees of the Company
    Management has disclosed all subsequent events, as applicable, that would have a significant effect on user organizations
    Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Anatomy of a SOC Report (Continued)
    Section 3 – Overview of Operations
    Company Overview
    Services Provided
    Organizational Chart
    Executive Management Team Professional Biographies
    Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Anatomy of a SOC Report (Continued)
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SECTION 4: Control Environment
    Control Environment
    Tone at the Top
    Discipline and Structure
    Risk Assessment
    Internal and External Risk Factors
    Identification of Risks
    Control Activities
    Policies and Procedures used to mitigate risk
    Information and Communications
    Processing of Company Transactions
    Reporting on Company Transactions
    Flow of communication throughout the Organization
    Monitoring
    Assessment of your activities to ensure compliance
  • Anatomy of a SOC Report (Continued)
    SECTION 4: Control Environment (Continued)
    Systems Overview
    Services provided – classes of transactions processed
    Description of procedures
    Transaction initiation
    Transaction authorization
    Processing
    Reporting
    Any changes that occurred within the audit period
    Subservice Organizations
    Brief description of what they do
    Carved-out of the report or included (inclusive method)
    Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
  • Anatomy of a SOC Report (Continued)
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SECTION 5: Control Objectives and Internal Control Structure
    Narrative description of the defined control objectives and control activities
    Includes within the process the defined control objectives and control activities
  • Anatomy of a SOC Report (Continued)
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SECTION 6: Information Provided by the Service Auditor
    Type I – Observation and Inquiry
    Type II – Test Procedures Performed and Testing Results
  • Anatomy of a SOC Report (Continued)
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SECTION 7: User Organization Control Considerations
    Examples of complementary administrative, physical, and technical controls
    Controls at user organizations that complement the controls at the service organization
    Example
    Client is responsible for complying with all accounting pronouncements and all laws or regulations related to internal controls
    Client is responsible for managing all system access and security authorizations
  • Anatomy of a SOC Report (Continued)
    Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    SECTION 8: Additional Information Provided by Company
    Information not included within the descriptions of controls
    Examples:
    Business Continuity
    Disaster Recovery Plans
    Changes that may be taking place in the future
    The service auditor does not opine on information within this section
  • Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    Anatomy of a SOC Report
    Questions?
  • Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    PRESENTERS
    Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Directormpettine@mfacornerstone.com(978) 557-5354
    Robert A. BuschCPAPartnerrbusch@mfa-cpa.com(978) 557-5327
    Michelle A. MackeyCFE, MBADirectormmackey@mfacornerstone.com(978) 569-2909
    IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.
  • Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.
    Anatomy of a SOC Report
    Thank you
    IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.