Service Organizations Control Reports

With several high profile internal control breakdowns and an increased focus on internal controls by regulators, the AICPA has developed the Service Organization reporting framework to help service organizations and their customers understand the types of examination reports they can request a CPA to issue.

Service Organization Control (“SOC”) 1 engagements are performed in accordance with Statements on Standards for Attestation Engagements (“SSAE”) no. 16 and are intended for the users’ accounting function and users’ auditors. They show controls relevant to financial reporting.

SOC 2 and SOC 3 engagements are performed in accordance with SSAE Attest Engagements, AT section 101, and are intended for management, regulators, and others to meet the needs of a broad range of users that need information and assurance about the controls at a service organization that affect the security, availability, and processing integrity of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems.

So which report is right for you?

  • A SOC 1 report is right for you if your customers and their auditors need the report to plan/perform an audit of their financial statements.
  • A SOC 2 report is right for you if the report will be used by customers/stakeholders to gain confidence and place trust in a service organization’s system. The customers/stakeholders have the need for/ability to understand the details of processing and controls at a service organization, the tests performed by the service auditor and results of those tests.
  • A SOC 3 report is right for you if the report will be used by customers/stakeholders to gain confidence and place trust in a service organization’s system. These reports are made generally available and are used for marketing purposes when the detail is not needed.
  • When necessary, you should also consider non-attest options as well.

As always, you should speak with a competent professional regarding your reporting needs and options.

Our dedicated SSAE 16 team helps clients achieve business and financial objectives. We understand the benefits of a SSAE 16 examination report, and are committed to helping you achieve those benefits. In conducting a SSAE 16 examination, Anders commits to providing you with outstanding service and value that will exceed your investment.