Our Services
SOC Reports FAQs
SOC Reports FAQs
Service organizations provide services to “user entities”, for which these services are likely to be relevant to these user entities’ internal control for financial reporting. They are generally required to conduct a SOC examination to obtain a recognized level of assurance on their internal controls. Typical organizations include:
- Software as a Service (SaaS)
- Outsourced Transaction Processors
- Outsourced Data Centers
- Credit Reporting Agency Resellers
- Security Operations Centers
- Healthcare Business Associates
- Professional Services (Accounting, Law, etc.)
Designed to help service organizations build trust and confidence through an independent CPA report.
Addresses internal control over financial reporting and demonstrates compliance with regulations like the Sarbanes-Oxley Act.
Focuses on IT service parameters (security, availability, privacy) to satisfy vendor management and regulatory requirements.
A short-form, less technical report with a "seal of approval" designed for marketing purposes and website display.
SOC 1: Statement on Standards for Attestation Engagements No. 16 (SSAE 16) guidance.
SOC 2 & SOC 3: AICPA - Canadian Institute of Chartered Accountants (CICA) Trust Services Principles and Criteria: security, availability, processing integrity, confidentiality, and privacy.
A report on procedures and controls put in place as of a specific point in time.
Provides evidence of how controls operated over an audit period (time duration).
Note: SOC 1 and SOC 2 can be either Type I or II. SOC 3 is neither.