SOC Examinations
SOC 1, SOC 2, SOC 3, and SOC for Cybersecurity
At BARR, we are committed to guiding you through the engagement process.
Why BARR for SOC Reporting
System and Organization Controls (SOC) Examinations
Differentiate your organization by reporting on controls that increase transparency and build trust with internal and external stakeholders.
A SOC 1 report, once known as SSAE16, helps service organizations demonstrate their controls specific to the client’s financial reporting. The report is most applicable when the service provider performs financial transaction processing or supports a transaction processing system. Control objectives are not pre-defined and need to be scoped prior to the reporting engagement or during a readiness assessment. SOC 1 reports are focused on user entities’ internal control over financial reporting (ICOFR). Examples of organizations that should consider a SOC 1 report include: Cloud ERP service providers, financial services, payroll processing, payment processing, healthcare claims processing and data center colocation.
SOC 2 reports apply more broadly to operational controls covering one or more of the five Trust Services Principles (TSPs): Security, availability, confidentiality, processing integrity, and/or privacy across a variety of systems. Examples of organizations that should consider a SOC 2 report include: Cloud service providers (e.g., SaaS, IaaS, PaaS), enterprise system housing third party data, IT systems management and data center colocation.
Much like the SOC 2 report, the SOC 3 examination reports on a service provider’s system security, availability, processing integrity, confidentiality, and/or privacy related to the Trust Services Principles; however, this report is considered to be for general use and can be distributed on a website for the public to read. Examples of organizations that should consider a SOC 3 report include: Cloud service providers (e.g., SaaS, IaaS, PaaS), enterprise system housing third party data, IT systems management and data center colocation.
Launched in 2017, SOC for Cybersecurity is a reporting framework over an entire entity’s cybersecurity risk management program and related controls. Unlike the traditional SOC reports, SOC for Cybersecurity can have other specific uses such as management reporting to a board or audit committee and a mechanism to demonstrate and communicate due diligence and due care in the entity’s cybersecurity program.
How it Works
Phase I SOC Readiness Assessment
Concerns about security and compliance reporting drive organizations to seek help with review of their procedures before undergoing the audit. The purpose of a readiness review is to identify control weaknesses that need correction. Deliverables from the readiness assessment include:
- Preliminary control discovery results that will assist in documenting process narratives and crafting the description of controls
- Control gaps and areas of improvement
- Prioritized observations and recommendations for remediation
The advantage of performing a readiness assessment prior to the SOC examination is to give management an opportunity to address control gaps prior to an inaugural SOC examination.
Phase II SOC Examination Reporting
BARR performs a SOC 1, SOC 2, and/or a SOC 3 examination. There are two types of reporting periods for most SOC reports including a Type 1 (point in time) and Type 2 (specified period of time). Both reports include a description of the overall business and control environment, control objectives, and the supporting control procedures in place to achieve the control objectives.
Deliverables of this phase include a Type 1 or a Type 2 report over any one, or combination of SOC 1, SOC 2, SOC 3 reporting frameworks using the control objectives, trust services principles, or other criteria specified by the client.
Contact Us for a Free Consultation
Speak with a BARR specialist about your security and compliance needs.
Client Testimonials
Frequently Asked Questions
Any organization that wants to differentiate themselves by reporting on controls that increase transparency and build trust with internal and external stakeholders should opt for SOC compliance. Speak with a SOC auditor at BARR to learn more about which type of SOC report may be best suited for your organization.
In addition to providing security and transparency, SOC reports demonstrate a commitment to protecting customer data. In many cases, a SOC report may be required to do business with a customer or third party.
Yes. A SOC report contains the auditor’s opinion on the design, effectiveness, and implementation of the relevant controls.
The type of SOC report best suited for your organization will depend on the requirements of your customers and stakeholders. Speaking with a trusted SOC auditor at BARR about your organization’s needs can help determine which SOC report is right for you.
No, completing a SOC audit does not result in any certification. Instead, the resulting report provides a CPA’s opinion on the design, effectiveness, and implementation of a service organization’s relevant internal controls. While no organization can technically be “SOC certified,” completing a SOC examination with BARR will help you demonstrate your commitment to protecting customer data.
