Anatomy of Service Organization Control (SOC) Reports - July 2011

1. Anatomy of a SOC Report Thursday, June 23, 2011 (1:00 pm – 2:00 pm)

2. Seminar Logistics All attendees are muted during the presentation – We cannot hear you Audio difficulties Hang up and redial (805) 309-0022 Enter access code 653-581-897 Enter the Audio Pin displayed on your Attendee Control Panel We will take questions at end of presentation During the presentation you may type questions into the Question Screen on your Attendee Control Panel – click Send Privately CPE credit Copy of today’s presentation Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.

3. About MFA Proactive CPA and consulting firm with national and global reach Offer a wide range of professional advisory services Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. <ul><li>Corporate Governance / Compliance Consulting

4. Performance & Controls Consulting

5. Fraud & Forensic Accounting

6. Litigation Support

7. IT Advisory

8. Professional Staffing

9. Audit & Assurance

10. Taxation

11. Valuation

12. M&A Transaction Services

13. Specialty GAAP Advisory

14. Wealth Advisory

15. Retirement Plan Advisory</li></li></ul><li>Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Presenters Robert A. BuschCPAPartner Michelle A. MackeyCFE, MBADirector Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Director

16. Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Agenda Attestation versus Auditing Standard SOC 1 versus SOC 2 or 3 – which report do I need? SOC 1 Report versus a SAS 70 Report SOC 2 Report SOC 3 Report Anatomy of a SOC Report Questions

18. Attestation versus Auditing Standard SAS 70 – Audit Standard In the past, the SAS 70 report was intended to assist service organizations’ customers and their auditors in the context of a financial statement audit. SSAE 16 – Attestation Standard (effective June 15, 2011) Traditional SAS 70 reports are being replaced by Service Organization Control Reports (or “SOC” reports) Now, three SOC reports have been defined to replace SAS 70 and help service organizations meet a broader set of specific user needs – including addressing security, privacy and availability. Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.

19. Reason for the change Need for greater international consistency (ISAE 3402) New Technologies (SaaS, cloud computing, privacy concerns for emerging technologies) Clarity of purpose (misunderstandings, misapplications, misuses of the former SAS 70 report) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.

21. SOC 1 versus SOC 2 or 3 – which report do I need? Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SOC 1 Former SAS 70 Reports – New SSAE 16 guidance Focuses on internal controls over the user organizations’ financial reporting Includes details about the systems and processes of the service organization Auditor to Auditor Report Restricted Use Report SOC 2 Primary interest around compliance and operational controls Includes details about the systems and processes of the service organization Trust Criteria: 1) Security, 2) Availability, 3) Processing Integrity, 4) Confidentiality, and 5) Privacy Restricted Use Report SOC 3 Primary interest around compliance and operational controls Similar to SOC 2 Report, but does not provide specific service organization company details Same work completed as the SOC 2 report General Use Report Seal can be placed on the service organization’s web site

23. Management assertion now within the report Opinion on the design of the controls Type I Report – design and the presentation of controls are still a point in time (“as of date”) Type II Report – opinion on the design of the controls and their operating effectiveness over the reporting period (“period of time”) Service organization still documents their control environment Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SOC 1 Report versus a SAS 70 Report

24. Trust Criteria versus User Organization Defined Objectives Five Principals Security Availability Processing Integrity Confidentiality Privacy Service Organization selects which principal they would like to report on Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SOC 2 Report

25. SOC 3 Report Most similar to SOC2, including the use of Trust Principles Reports itself omits specific detail regarding control testing Only General Use report – can be shared with prospects May have only limited value to user organization auditors Optional SOC3 seal available for the website Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.

28. Anatomy of a SOC Report Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 1: Auditor’s Opinion The “opinion” by the service auditor Description of controls is fairly stated (no omissions or distortions) Controls were suitably designed to achieve the stated control objective Controls are effectively designed (Type I) Controls were operating effectively (Type II)

30. Anatomy of a SOC Report (Continued) SECTION 2: Management Assertion (Continued) Management has determined the control objectives and control activities are reflected within the report Management believes the description of the controls are fairly presented Controls are suitably designed to achieve control objectives Management is not aware of any illegal acts, fraud, or uncorrected errors by management employees of the Company Management has disclosed all subsequent events, as applicable, that would have a significant effect on user organizations Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.

31. Anatomy of a SOC Report (Continued) Section 3 – Overview of Operations Company Overview Services Provided Organizational Chart Executive Management Team Professional Biographies Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.

32. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 4: Control Environment Control Environment Tone at the Top Discipline and Structure Risk Assessment Internal and External Risk Factors Identification of Risks Control Activities Policies and Procedures used to mitigate risk Information and Communications Processing of Company Transactions Reporting on Company Transactions Flow of communication throughout the Organization Monitoring Assessment of your activities to ensure compliance

33. Anatomy of a SOC Report (Continued) SECTION 4: Control Environment (Continued) Systems Overview Services provided – classes of transactions processed Description of procedures Transaction initiation Transaction authorization Processing Reporting Any changes that occurred within the audit period Subservice Organizations Brief description of what they do Carved-out of the report or included (inclusive method) Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.

34. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 5: Control Objectives and Internal Control Structure Narrative description of the defined control objectives and control activities Includes within the process the defined control objectives and control activities

35. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 6: Information Provided by the Service Auditor Type I – Observation and Inquiry Type II – Test Procedures Performed and Testing Results

36. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 7: User Organization Control Considerations Examples of complementary administrative, physical, and technical controls Controls at user organizations that complement the controls at the service organization Example Client is responsible for complying with all accounting pronouncements and all laws or regulations related to internal controls Client is responsible for managing all system access and security authorizations

37. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 8: Additional Information Provided by Company Information not included within the descriptions of controls Examples: Business Continuity Disaster Recovery Plans Changes that may be taking place in the future The service auditor does not opine on information within this section

39. Copyright 2009. Moody, Famiglietti & Andronico, LLP. All Rights Reserved. PRESENTERS Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Directormpettine@mfacornerstone.com(978) 557-5354 Robert A. BuschCPAPartnerrbusch@mfa-cpa.com(978) 557-5327 Michelle A. MackeyCFE, MBADirectormmackey@mfacornerstone.com(978) 569-2909 IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.

40. Copyright 2009. Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Anatomy of a SOC Report Thank you IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.