System and Organization Controls (SOC) Services

SOC Reporting has become the most widely accepted report on controls at subservice organizations, providing a value proposition that differentiates your organization from your competition.

We provide the following SOC Examinations to help organizations assess and report on the design and operating effectiveness of their internal controls:

• SOC Readiness Assessments
• SOC 1, Type 1
• SOC 1, Type 2
• SOC 2, Type 1
• SOC 2, Type 2
• SOC 3

System and Organization Controls (SOC) are a suite of service offerings CPAs may provide in connection with system-level controls of a service organization or entity-level controls of other organizations. The most common SOC reports are SOC 1, SOC 2, and SOC 3 Reports. The intended users of each report are included below:

SOC 1: SOC for Service Organizations: ICFR - To provide management of the service organization, user entities, and the independent auditors of user entities’ financial statements with information, including a service auditor’s opinion, about controls of a service organization that are likely to be relevant to user entities’ internal control over financial reporting.

SOC 2: SOC for Service Organizations: Trust Services Criteria - To provide service organization management, user entities, business partners, and other parties with information about controls of the service organization relevant to security, availability, processing integrity, confidentiality, and/or privacy to support users’ evaluations of their own systems of internal control.

SOC 3: SOC for Service Organizations - Trust Services Criteria for General Use Report to provide interested parties with a service auditor’s opinion about the effectiveness of controls at the service organization relevant to security, availability, processing integrity, confidentiality, and/or privacy.

When beginning your SOC journey, consider starting with a SOC Readiness Assessment and working up the ladder of SOC reports.

This service helps organizations using Amazon Web Services (AWS) demonstrate strong internal controls through SOC Readiness Assessments and SOC 1, SOC 2, and SOC 3 Examinations. SOC Reports are relevant to AWS-hosted environments and services such as Amazon EC2, Amazon S3, Amazon RDS, and AWS Lambda, helping customers support compliance, enhance trust, and validate security and operational controls.