SOC® Reports
What is a SOC Report?
System and Organization Controls (SOC) reports allow service providers to demonstrate that they are operating in an ethical and compliant manner. Used by SaaS vendors, cloud service providers, data center and colocation providers, payroll processors, third-party administrators, healthcare organizations, and service organizations in a variety of other verticals, SOC reports establish credibility and trustworthiness for user entities and internal stakeholders. Because the reports demonstrate a high level of commitment to information security, they can help you create a competitive advantage that is well worth the time and resources.
Our SOC Reporting Services
As a licensed CPA firm, 360 Advanced provides a full suite of SOC reporting services.
Our Approach to SOC Reporting
Your SOC report should support your organization’s unique needs – as well as your customers’ expectations. Our team will help you determine the most appropriate scope for your examination. Your SOC report can cover:
- Security
- Availability
- Processing Integrity
- Confidentiality
- Privacy
- Controls related to financial reporting
- Controls related to cybersecurity
- Controls related to supply chain operations
We can also include additional information about procedures that fall outside the traditional subject matter of a SOC report. You can discuss any additional procedures with your auditor during the scoping process.
Once you’ve decided what information to include in your report, you will need to decide if you should start with a Readiness Assessment or move directly into a formal SOC examination. If this is your first SOC examination, a Readiness Assessment can help you identify gaps in your controls. From there, we provide tailored feedback for you to utilize in your remediation plan.
For your formal examination, your team will develop a description of your system elements; collect documentation; and schedule on-site testing (virtual or in-person). Our team can guide you through the entire process, helping you create a detailed project plan that will keep your engagement on track.
SOC Report Types
SOC 1 Readiness Assessment
A SOC 1 Readiness Assessment is a preliminary assessment that can help you successfully prepare for – and increase your chances of receiving an unqualified opinion on – a SOC 1 Type 1 or Type 2 examination. For a Readiness Assessment, we will identify specific controls and control gaps related to the achievement of control objectives for the services being audited, then provide specific, actionable guidance for management to make decisions about improving and maintaining your system of controls.
SOC 1 Type 1 Report
A SOC 1 Type 1 examination can determine if your internal controls have been appropriately designed to meet your control objectives. The resulting report demonstrates to your clients – and their risk management teams – that you have accurately represented the description of your system of controls, and that your controls are suitably designed and placed into operation.
SOC 1 Type 2 Report
A SOC 1 Type 2 examination covers the same objectives as a SOC 1 Type 1 examination, but the opinion includes whether or not these controls were operating effectively during a specific period of time. The corresponding report includes additional information regarding our auditors’ tests of your controls; this provides an additional level of assurance for your customers. It can also help you continually review and improve your security posture, as you can identify controls that are not meeting their intended purpose and develop a plan to improve them.
SOC 1 Report
A SOC 1 report, as defined by the American Institute of Certified Public Accountants (AICPA), is a “Report on Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting.” This type of report provides independent assurance that your internal controls affecting your customers’ financial reporting are appropriately designed and implemented.
SOC 2 Readiness Assessment
A SOC 2 Readiness Assessment is similar to a SOC 1 Readiness Assessment. Our auditors will evaluate your controls and control gaps, then provide actionable guidance as you improve your policies and procedures. The goal is to help you successfully prepare for – and increase your chances of receiving an unqualified opinion on – a SOC 2 Type 1 or SOC 2 Type 2 examination.
SOC 2 Type 1 Report
A SOC 2 Type 1 examination will provide an opinion about whether your controls have been appropriately designed to meet the requirements defined in the criteria under each category. The corresponding report addresses the design and implementation of your system of controls as of a point in time. This can help your management team improve the maturity of your core processes; it can also help you prepare for a future SOC 2 Type 2 examination.
SOC 2 Type 2 Report
A SOC 2 Type 2 examination covers the same objectives as a SOC 2 Type 1 examination, but the opinion includes whether or not these controls were operating effectively during a specific period of time to meet the requirements defined in the criteria under each category. This helps you continually ensure that your processes meet your organization’s security objectives, while helping you communicate your efforts to your user entities.
SOC 2 Report
A SOC 2 report is an attestation that provides an opinion on the design and effectiveness of your operational controls. SOC 2 reports are based on the five AICPA Trust Services Categories; every SOC 2 report covers Security, and you can choose to include Availability, Processing Integrity, Confidentiality and/or Privacy based on your organization’s needs.
SOC 3 Report
A SOC 3 report is based on a SOC 2 Type 2 report. However, while SOC 2 reports can only be shared with a limited audience, a SOC 3 report can be shared publicly. In a SOC 3 report, confidential information is redacted to make it appropriate for general use. These reports are most commonly used to support sales and marketing efforts.
SOC for Cybersecurity
SOC for Cybersecurity reports can help you manage cybersecurity threats. These examinations help you evaluate your cybersecurity and risk management programs and communicate the details of your efforts to key stakeholders. As with a SOC 3 report, a SOC for Cybersecurity report is designed for general use and is a valuable tool to provide to your board of directors, business partners, and prospective customers.
SOC for Supply Chain
SOC for Supply Chain examinations allow you to identify, evaluate, and mitigate risks that could disrupt your manufacturing and distribution operations.
Why Obtain Your SOC Report From 360 Advanced?
We’re more than just a CPA firm. Our auditors have strong technical backgrounds that help them thoroughly evaluate your system and controls. You have the peace of mind that comes with knowing your environment has been thoroughly assessed – not just to meet a specific reporting initiative, but to help you develop the strongest possible privacy and security posture.
Our integrated approach also makes it easy to complete your SOC examination at the same time as your other compliance efforts. We can map your internal controls to the requirements for other assessments – such as HIPAA security compliance assessments and PCI assessments – making the entire process faster and more cost-effective.