Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Anatomy of Service Organization Control (SOC) Reports - July 2011

Following the recent release of final guidance from the American Institute of Certified Public Accountants (AICPA) on the new Service Organization Control (SOC) reporting options—and the retiring of the SAS 70 standard as of June 15, 2011—we thought this would be an appropriate time to answer the question many financial, technical and marketing executives have been asking: What does a SOC report look like?

  • Login to see the comments

Anatomy of Service Organization Control (SOC) Reports - July 2011

  1. 1. Anatomy of a SOC Report<br />Thursday, June 23, 2011 (1:00 pm – 2:00 pm)<br />
  2. 2. Seminar Logistics<br />All attendees are muted during the presentation<br />– We cannot hear you<br />Audio difficulties<br />Hang up and redial (805) 309-0022<br />Enter access code 653-581-897 <br />Enter the Audio Pin displayed on your Attendee Control Panel<br />We will take questions at end of presentation<br />During the presentation you may type questions into the Question Screen on your Attendee Control Panel – click Send Privately<br />CPE credit<br />Copy of today’s presentation<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  3. 3. About MFA<br />Proactive CPA and consulting firm with national and global reach<br />Offer a wide range of professional advisory services<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br /><ul><li>Corporate Governance / Compliance Consulting
  4. 4. Performance & Controls Consulting
  5. 5. Fraud & Forensic Accounting
  6. 6. Litigation Support
  7. 7. IT Advisory
  8. 8. Professional Staffing
  9. 9. Audit & Assurance
  10. 10. Taxation
  11. 11. Valuation
  12. 12. M&A Transaction Services
  13. 13. Specialty GAAP Advisory
  14. 14. Wealth Advisory
  15. 15. Retirement Plan Advisory</li></li></ul><li>Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Presenters<br />Robert A. BuschCPAPartner<br />Michelle A. MackeyCFE, MBADirector<br />Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Director<br />
  16. 16. Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Agenda<br />Attestation versus Auditing Standard<br />SOC 1 versus SOC 2 or 3 – which report do I need?<br />SOC 1 Report versus a SAS 70 Report<br />SOC 2 Report<br />SOC 3 Report<br />Anatomy of a SOC Report<br />Questions<br />
  17. 17. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Attestation versus Auditing Standard<br />
  18. 18. Attestation versus Auditing Standard<br />SAS 70 – Audit Standard<br />In the past, the SAS 70 report was intended to assist service organizations’ customers and their auditors in the context of a financial statement audit. <br />SSAE 16 – Attestation Standard (effective June 15, 2011)<br />Traditional SAS 70 reports are being replaced by Service Organization Control Reports (or “SOC” reports) <br />Now, three SOC reports have been defined to replace SAS 70 and help service organizations meet a broader set of specific user needs – including addressing security, privacy and availability.<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  19. 19. Reason for the change<br />Need for greater international consistency (ISAE 3402)<br />New Technologies (SaaS, cloud computing, privacy concerns for emerging technologies)<br />Clarity of purpose (misunderstandings, misapplications, misuses of the former SAS 70 report)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  20. 20. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Which Report do I need?<br />
  21. 21. SOC 1 versus SOC 2 or 3 – which report do I need?<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SOC 1<br />Former SAS 70 Reports – New SSAE 16 guidance<br />Focuses on internal controls over the user organizations’ financial reporting<br />Includes details about the systems and processes of the service organization<br />Auditor to Auditor Report<br />Restricted Use Report<br />SOC 2<br />Primary interest around compliance and operational controls<br />Includes details about the systems and processes of the service organization<br />Trust Criteria: 1) Security, 2) Availability, 3) Processing Integrity, 4) Confidentiality, and 5) Privacy<br />Restricted Use Report<br />SOC 3<br />Primary interest around compliance and operational controls<br />Similar to SOC 2 Report, but does not provide specific service organization company details<br />Same work completed as the SOC 2 report<br />General Use Report<br />Seal can be placed on the service organization’s web site<br />
  22. 22. SOC 1 versus SOC 2 or 3 – which report do I need?<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  23. 23. Management assertion now within the report<br />Opinion on the design of the controls<br />Type I Report – design and the presentation of controls are still a point in time (“as of date”)<br />Type II Report – opinion on the design of the controls and their operating effectiveness over the reporting period (“period of time”)<br />Service organization still documents their control environment<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SOC 1 Report versus a SAS 70 Report<br />
  24. 24. Trust Criteria versus User Organization Defined Objectives<br />Five Principals<br />Security<br />Availability<br />Processing Integrity<br />Confidentiality<br />Privacy<br />Service Organization selects which principal they would like to report on <br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SOC 2 Report<br />
  25. 25. SOC 3 Report<br />Most similar to SOC2, including the use of Trust Principles<br />Reports itself omits specific detail regarding control testing<br />Only General Use report – can be shared with prospects<br />May have only limited value to user organization auditors<br />Optional SOC3 seal available for the website<br />Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  26. 26. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Anatomy of a SOC Report<br />
  27. 27. Anatomy of a SOC Report<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  28. 28. Anatomy of a SOC Report<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 1: Auditor’s Opinion<br />The “opinion” by the service auditor<br />Description of controls is fairly stated (no omissions or distortions)<br />Controls were suitably designed to achieve the stated control objective<br />Controls are effectively designed (Type I)<br />Controls were operating effectively (Type II)<br />
  29. 29. Anatomy of a SOC Report (Continued)<br />SECTION 2: Management Assertion<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  30. 30. Anatomy of a SOC Report (Continued)<br />SECTION 2: Management Assertion (Continued)<br />Management has determined the control objectives and control activities are reflected within the report<br />Management believes the description of the controls are fairly presented<br />Controls are suitably designed to achieve control objectives<br />Management is not aware of any illegal acts, fraud, or uncorrected errors by management employees of the Company<br />Management has disclosed all subsequent events, as applicable, that would have a significant effect on user organizations<br />Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  31. 31. Anatomy of a SOC Report (Continued)<br />Section 3 – Overview of Operations<br />Company Overview<br />Services Provided<br />Organizational Chart<br />Executive Management Team Professional Biographies<br />Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  32. 32. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 4: Control Environment<br />Control Environment<br />Tone at the Top<br />Discipline and Structure<br />Risk Assessment<br />Internal and External Risk Factors<br />Identification of Risks<br />Control Activities<br />Policies and Procedures used to mitigate risk<br />Information and Communications<br />Processing of Company Transactions<br />Reporting on Company Transactions<br />Flow of communication throughout the Organization<br />Monitoring<br />Assessment of your activities to ensure compliance<br />
  33. 33. Anatomy of a SOC Report (Continued)<br />SECTION 4: Control Environment (Continued)<br />Systems Overview<br />Services provided – classes of transactions processed<br />Description of procedures<br />Transaction initiation<br />Transaction authorization<br />Processing <br />Reporting<br />Any changes that occurred within the audit period<br />Subservice Organizations<br />Brief description of what they do<br />Carved-out of the report or included (inclusive method)<br />Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
  34. 34. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 5: Control Objectives and Internal Control Structure<br />Narrative description of the defined control objectives and control activities<br />Includes within the process the defined control objectives and control activities<br />
  35. 35. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 6: Information Provided by the Service Auditor<br />Type I – Observation and Inquiry<br />Type II – Test Procedures Performed and Testing Results<br />
  36. 36. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 7: User Organization Control Considerations<br />Examples of complementary administrative, physical, and technical controls<br />Controls at user organizations that complement the controls at the service organization<br />Example<br />Client is responsible for complying with all accounting pronouncements and all laws or regulations related to internal controls<br />Client is responsible for managing all system access and security authorizations<br />
  37. 37. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 8: Additional Information Provided by Company<br />Information not included within the descriptions of controls<br />Examples: <br />Business Continuity<br />Disaster Recovery Plans<br />Changes that may be taking place in the future<br />The service auditor does not opine on information within this section<br />
  38. 38. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Anatomy of a SOC Report<br />Questions?<br />
  39. 39. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />PRESENTERS<br />Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Directormpettine@mfacornerstone.com(978) 557-5354<br />Robert A. BuschCPAPartnerrbusch@mfa-cpa.com(978) 557-5327<br />Michelle A. MackeyCFE, MBADirectormmackey@mfacornerstone.com(978) 569-2909<br />IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.<br />
  40. 40. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Anatomy of a SOC Report<br />Thank you<br />IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.<br />

×