Understanding Your SOC 1 Audit Report: What are Control Objectives?
by Joseph Kirkpatrick / November 29th, 2017
What are Control Objectives and How are They Used in a SOC 1 Audit Report?
A key aspect of a SOC 1 audit report is the concept of control objectives. Control objectives are a series of statements that address how risk is going to be effectively mitigated. According to the PCAOB, “A control objective provides a specific target against which to evaluate the effectiveness of controls. A control objective for internal control over financial reporting generally relates to a relevant assertion and states a criterion for evaluating whether the company’s control procedures in a specific area provide reasonable assurance that a misstatement or omission in that relevant assertion is prevented or detected by controls on a timely basis.”
How Do You Determine Control Objectives?
There are typically 10 to 30 control objectives in a SOC 1 report, which an auditor will help you design. When scoping a SOC 1 engagement, you can create and organize a complete set of control objectives. One exercise to try is asking management to list all of the key services or activities that you, the service organization, provide to user organizations. This can help you tailor control objectives to exactly what activities you perform.
Let’s say your control objective is, “Our controls provide reasonable assurance that we restrict unauthorized access to our critical systems.” In order to achieve this control objective, your organization should implement controls in place such as locked doors, badges, monitoring systems, and logical access controls, which all restrict unauthorized access to critical systems.
If it’s your first time having a SOC 1 audit performed, we strongly recommend starting with a gap analysis of your organization’s internal controls in order to identify operational, reporting, and compliance gaps and to provide advice on strategies to manage control objectives going forward. If you have questions about SOC 1 audits or want help demonstrating to your clients your commitment to security and compliance, contact us today.
More SOC 1 Resources
Top 10 Things to Prepare You for Your SOC 1 Audit
Everything You Need to Know About SOC 1 Audits
3 Reasons to Stop Hesitating and Complete Your SOC 1 Audit
Part of the terminology that you will see over and over in your SOC 1 report is the concept of control objectives. The auditor will assist you in writing your control objectives. This is what you’re trying to achieve with the implementation of control.
Let me give you an example: our controls provide reasonable assurance that we restrict unauthorized access to our critical systems. You put into place controls such as locked doors, badges, monitoring systems, logical access controls. These controls have been put into place and have been designed to achieve the control objective, which is to restrict unauthorized access.
There are typically 10 to 30 objectives in a SOC 1 report, on average. These would be determined by what you do as an organization. So, our auditors would assist you in designing the way in which those control objectives are written, because those would be key parts in the SOC 1 report.
