Service Organization Control (SOC) reports have become increasingly important for service organizations to demonstrate internal controls over financial reporting. Prior to initiating a new SOC report, a service organization should conduct an independent readiness assessment to identify potential control weaknesses and allow time to remediate them. The readiness assessment involves reviewing the system description, testing identified controls, and developing a remediation plan for any weaknesses found. This helps minimize weaknesses communicated in the final SOC report and gives service organizations confidence in what they project to customers.

1. Crossland Advisors, Inc.
http://crosslandadvisors.com/
610-365-4852
Copyright © 2016
Planning for a New Service Organization Control Report (SOC1, SOC2 or SOC3)?
Service Organization Control (SOC) reports have significantly evolved in importance
and demand over the past several years. From the days of SAS 70 reports (the AICPA
standard was issued in 1992), primarily an auditor-to-auditor communication, to the
current SOC standards (issued in 2010 and amended in 2013), the result of significant
changes in the regulatory landscape and the growth of business and technology
outsourcing. Governments, regulators, boards of directors and financial statement
users are placing ever-increasing emphasis on services performed by a service
organization that relate to internal controls over financial reporting.
Prior to initiating a new SOC report (SOC1, SOC2 or SOC3), the service organization
should seriously consider having an independent readiness assessment. A readiness
assessment, when planned and performed appropriately, identifies potential control
weaknesses that should be remediated prior to the actual SOC attestation project
being performed. Accordingly, the timing of the readiness assessment should consider
providing time to remediate observed weaknesses prior to the start of the SOC
reporting period.
A readiness assessment begins with a review of a written description of the designed
and implemented system that is the subject of the eventual SOC report. If no
description is available, one should be developed including certain specified elements
as defined by the AICPA. The description should include the related processes, people,
and technology. For a SOC1 report, the control objectives and related controls of the
system being evaluated should be confirmed as applicable and included in the
description. Also, the stated controls should address the achievement of each control
objective. For a SOC2 or SOC3 report, the description should include the controls
designed to achieve the criteria for the Trust Services principle(s) in scope. An initial
summary of control gaps will be the result of the review of the system description.
Once the system description is validated, the identified controls to achieve the control
objectives or criteria should be tested by walkthroughs or small samples to ascertain
whether or not they are actually implemented and operating effectively as designed;
control weaknesses will be the result of such control testing. A remediation plan should
be developed for any control weaknesses identified. Depending on the severity of the
weaknesses, testing may need to be re-performed and the period to be covered by the
SOC report may need to be changed to accommodate the remediation efforts.
Given the confidence that service organizations want to project to their customers, a
SOC readiness assessment is the first step in minimizing potential weaknesses from
being communicated in the actual final report.

2. Crossland Advisors, Inc.
http://crosslandadvisors.com/
610-365-4852
Copyright © 2016
Crossland Advisors provides IT risk and control services to a number of industries,
including:
 Manufacturing
 Pharmaceuticals
 Healthcare
 Financial Services
 Insurance
 Government
 Retail
 Utilities
Our extensive experience allows us to develop real world solutions to complex
challenges. We use a process-focused risk-based approach and are able to relate
leading practices and improvements to understand, anticipate and address a wide
variety of information system risk and process issues.
Crossland Advisors is ready to work with you to satisfy your IT risk and control needs.