Anatomy of Service Organization Control (SOC) Reports - July 2011

1,055 views

Published on

Following the recent release of final guidance from the American Institute of Certified Public Accountants (AICPA) on the new Service Organization Control (SOC) reporting options—and the retiring of the SAS 70 standard as of June 15, 2011—we thought this would be an appropriate time to answer the question many financial, technical and marketing executives have been asking: What does a SOC report look like?

Published in: Technology, Business
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
1,055
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
0
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide
  • I’d like to now introduce our speakers for this afternoon – our resident SAS 70 and SOC experts - Rob Busch,Michelle Mackey and Matt Pettine. Their respective backgrounds and areas of expertise ensure our clients get a well-rounded perspective and result in engagement deliverables that allow our clients to confidently demonstrate that their infrastructure, applications and processes are appropriately designed and operating effectively, which in turn paves the way for them to build trust with their customers.Our first speaker, Rob Bush, is an Audit Partner here at MFA. Rob has over fifteen years of experience in audit, reviews, and compilations. He works closely with clients on a variety of technical and business issues including revenue recognition, stock-based compensation, equity transactions, business combinations , SAS 70 and SOC audits and surprise examinations for registered investment advisors. He has extensive experience in Sarbanes-Oxley compliance consulting, SEC reporting, and performing financial statement audits for companies in the construction, high tech, service, manufacturing, and distribution industries.Our second speaker for this afternoon is Michelle Mackey. Michelle is a Director for MFA’s affiliate company, MFA Cornerstone Consulting, and plays an instrumental role in helping the firm's clients optimize performance, control risk and adhere to regulatory compliance.  Michelle is sought after by clients for her expertise, particularly in the area of business process efficiency, SAS 70 and Sarbanes-Oxley compliance.  In addition, as a Certified Fraud Examiner, Michelle works closely with clients to identify areas of fraud susceptibility within their current systems, procedures and transactions.   Our third and final speaker this afternoon is Matt Pettine. Matt is the Managing Director of the IT Advisory Practice for MFA’s affiliate company, MFA Cornerstone Consulting. In his role Matt provides:-technical and managerial consulting -business risk assessment-customized application development -and infrastructure solutions.  Matt assists clients in all aspects of MIS infrastructure and IT support, including -design, -planning, -system controls, -and hands-on implementation, testing and maintenance.So without further ado, I’d like to turn the floor over to Rob.
  • Thank you Michelle,Rob and Matt. We’d now like to address some of the questions sent to us during the presentation.Our first question is…
  • OK, that’s all the time we have for questions today. If we did not get to your question, we’ve made a note of it and will be sure to follow-up with you individually.Before we sign off, do any of the presenters have any final thoughts you want to leave the audience with?I’d like to thank all of you for joining us today. If you’d like to further discuss the new SOC reporting options and their applicability to your organization, please feel free to contact Rob, Michelle or Matt at the phone numbers or email addresses on the screen. And as a final reminder, we will be following up and sending all of you a link to access today’s presentation.Again, thank you for your time today.
  • Anatomy of Service Organization Control (SOC) Reports - July 2011

    1. 1. Anatomy of a SOC Report<br />Thursday, June 23, 2011 (1:00 pm – 2:00 pm)<br />
    2. 2. Seminar Logistics<br />All attendees are muted during the presentation<br />– We cannot hear you<br />Audio difficulties<br />Hang up and redial (805) 309-0022<br />Enter access code 653-581-897 <br />Enter the Audio Pin displayed on your Attendee Control Panel<br />We will take questions at end of presentation<br />During the presentation you may type questions into the Question Screen on your Attendee Control Panel – click Send Privately<br />CPE credit<br />Copy of today’s presentation<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    3. 3. About MFA<br />Proactive CPA and consulting firm with national and global reach<br />Offer a wide range of professional advisory services<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br /><ul><li>Corporate Governance / Compliance Consulting
    4. 4. Performance & Controls Consulting
    5. 5. Fraud & Forensic Accounting
    6. 6. Litigation Support
    7. 7. IT Advisory
    8. 8. Professional Staffing
    9. 9. Audit & Assurance
    10. 10. Taxation
    11. 11. Valuation
    12. 12. M&A Transaction Services
    13. 13. Specialty GAAP Advisory
    14. 14. Wealth Advisory
    15. 15. Retirement Plan Advisory</li></li></ul><li>Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Presenters<br />Robert A. BuschCPAPartner<br />Michelle A. MackeyCFE, MBADirector<br />Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Director<br />
    16. 16. Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Agenda<br />Attestation versus Auditing Standard<br />SOC 1 versus SOC 2 or 3 – which report do I need?<br />SOC 1 Report versus a SAS 70 Report<br />SOC 2 Report<br />SOC 3 Report<br />Anatomy of a SOC Report<br />Questions<br />
    17. 17. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Attestation versus Auditing Standard<br />
    18. 18. Attestation versus Auditing Standard<br />SAS 70 – Audit Standard<br />In the past, the SAS 70 report was intended to assist service organizations’ customers and their auditors in the context of a financial statement audit. <br />SSAE 16 – Attestation Standard (effective June 15, 2011)<br />Traditional SAS 70 reports are being replaced by Service Organization Control Reports (or “SOC” reports) <br />Now, three SOC reports have been defined to replace SAS 70 and help service organizations meet a broader set of specific user needs – including addressing security, privacy and availability.<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    19. 19. Reason for the change<br />Need for greater international consistency (ISAE 3402)<br />New Technologies (SaaS, cloud computing, privacy concerns for emerging technologies)<br />Clarity of purpose (misunderstandings, misapplications, misuses of the former SAS 70 report)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    20. 20. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Which Report do I need?<br />
    21. 21. SOC 1 versus SOC 2 or 3 – which report do I need?<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SOC 1<br />Former SAS 70 Reports – New SSAE 16 guidance<br />Focuses on internal controls over the user organizations’ financial reporting<br />Includes details about the systems and processes of the service organization<br />Auditor to Auditor Report<br />Restricted Use Report<br />SOC 2<br />Primary interest around compliance and operational controls<br />Includes details about the systems and processes of the service organization<br />Trust Criteria: 1) Security, 2) Availability, 3) Processing Integrity, 4) Confidentiality, and 5) Privacy<br />Restricted Use Report<br />SOC 3<br />Primary interest around compliance and operational controls<br />Similar to SOC 2 Report, but does not provide specific service organization company details<br />Same work completed as the SOC 2 report<br />General Use Report<br />Seal can be placed on the service organization’s web site<br />
    22. 22. SOC 1 versus SOC 2 or 3 – which report do I need?<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    23. 23. Management assertion now within the report<br />Opinion on the design of the controls<br />Type I Report – design and the presentation of controls are still a point in time (“as of date”)<br />Type II Report – opinion on the design of the controls and their operating effectiveness over the reporting period (“period of time”)<br />Service organization still documents their control environment<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SOC 1 Report versus a SAS 70 Report<br />
    24. 24. Trust Criteria versus User Organization Defined Objectives<br />Five Principals<br />Security<br />Availability<br />Processing Integrity<br />Confidentiality<br />Privacy<br />Service Organization selects which principal they would like to report on <br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SOC 2 Report<br />
    25. 25. SOC 3 Report<br />Most similar to SOC2, including the use of Trust Principles<br />Reports itself omits specific detail regarding control testing<br />Only General Use report – can be shared with prospects<br />May have only limited value to user organization auditors<br />Optional SOC3 seal available for the website<br />Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    26. 26. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Anatomy of a SOC Report<br />
    27. 27. Anatomy of a SOC Report<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    28. 28. Anatomy of a SOC Report<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 1: Auditor’s Opinion<br />The “opinion” by the service auditor<br />Description of controls is fairly stated (no omissions or distortions)<br />Controls were suitably designed to achieve the stated control objective<br />Controls are effectively designed (Type I)<br />Controls were operating effectively (Type II)<br />
    29. 29. Anatomy of a SOC Report (Continued)<br />SECTION 2: Management Assertion<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    30. 30. Anatomy of a SOC Report (Continued)<br />SECTION 2: Management Assertion (Continued)<br />Management has determined the control objectives and control activities are reflected within the report<br />Management believes the description of the controls are fairly presented<br />Controls are suitably designed to achieve control objectives<br />Management is not aware of any illegal acts, fraud, or uncorrected errors by management employees of the Company<br />Management has disclosed all subsequent events, as applicable, that would have a significant effect on user organizations<br />Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    31. 31. Anatomy of a SOC Report (Continued)<br />Section 3 – Overview of Operations<br />Company Overview<br />Services Provided<br />Organizational Chart<br />Executive Management Team Professional Biographies<br />Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    32. 32. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 4: Control Environment<br />Control Environment<br />Tone at the Top<br />Discipline and Structure<br />Risk Assessment<br />Internal and External Risk Factors<br />Identification of Risks<br />Control Activities<br />Policies and Procedures used to mitigate risk<br />Information and Communications<br />Processing of Company Transactions<br />Reporting on Company Transactions<br />Flow of communication throughout the Organization<br />Monitoring<br />Assessment of your activities to ensure compliance<br />
    33. 33. Anatomy of a SOC Report (Continued)<br />SECTION 4: Control Environment (Continued)<br />Systems Overview<br />Services provided – classes of transactions processed<br />Description of procedures<br />Transaction initiation<br />Transaction authorization<br />Processing <br />Reporting<br />Any changes that occurred within the audit period<br />Subservice Organizations<br />Brief description of what they do<br />Carved-out of the report or included (inclusive method)<br />Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />
    34. 34. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 5: Control Objectives and Internal Control Structure<br />Narrative description of the defined control objectives and control activities<br />Includes within the process the defined control objectives and control activities<br />
    35. 35. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 6: Information Provided by the Service Auditor<br />Type I – Observation and Inquiry<br />Type II – Test Procedures Performed and Testing Results<br />
    36. 36. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 7: User Organization Control Considerations<br />Examples of complementary administrative, physical, and technical controls<br />Controls at user organizations that complement the controls at the service organization<br />Example<br />Client is responsible for complying with all accounting pronouncements and all laws or regulations related to internal controls<br />Client is responsible for managing all system access and security authorizations<br />
    37. 37. Anatomy of a SOC Report (Continued)<br />Copyright 2011. MFA -  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />SECTION 8: Additional Information Provided by Company<br />Information not included within the descriptions of controls<br />Examples: <br />Business Continuity<br />Disaster Recovery Plans<br />Changes that may be taking place in the future<br />The service auditor does not opine on information within this section<br />
    38. 38. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Anatomy of a SOC Report<br />Questions?<br />
    39. 39. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />PRESENTERS<br />Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Directormpettine@mfacornerstone.com(978) 557-5354<br />Robert A. BuschCPAPartnerrbusch@mfa-cpa.com(978) 557-5327<br />Michelle A. MackeyCFE, MBADirectormmackey@mfacornerstone.com(978) 569-2909<br />IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.<br />
    40. 40. Copyright 2009.  Moody, Famiglietti & Andronico, LLP.  All Rights Reserved.<br />Anatomy of a SOC Report<br />Thank you<br />IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.<br />

    ×