Understanding Your SOC 1 Report: Determining your Audit Period
by Joseph Kirkpatrick / January 10th, 2018
Operating Effectively Over a Period of Time
When considering pursuing a SOC 1 Type II report, there’s a new element to consider: determining your audit period. It’s important to remember that a SOC 1 Type I and a SOC 1 Type II both report on the controls and processes at a service organization that may impact their user entities’ internal control over financial reporting. However, unlike a Type I report, Type II reports include an opinion on whether the controls were operating effectively over a period of time. Assessing the operating effectiveness of controls over a period of time helps the auditor determine whether controls have been implemented. If the controls are found to be operating effectively over a period of time, then the control objectives have been achieved.
If you are required to receive a SOC 1 Type II report, your service organization will undergo more testing than in a SOC 1 Type I audit. Because additional testing is necessary to determine that the controls are not only in place, but also operating effectively over a period of time, SOC 1 Type II audits take more time to conduct.
It’s common to ask, “How do we determine our audit period?” when planning a SOC 1 Type II audit. That needs to be a conversation you have with your auditor. The review period is typically six to 12 months, but because every circumstance is different, you and your auditor must determine what’s appropriate for your service organization.
Considering client needs and timing constraints is critical when pursuing a SOC 1 Type II report. If you have questions about SOC 1 reports, view more of our SOC 1 video resources or contact us today.
For your SSAE 16 (SOC 1 Type II) Type II report, the controls that are under review have to have been put in place for a period of time and the auditor will perform tests of operating effectiveness to ensure that those controls were operating effectively over that period of time.
One of the questions that we receive is, “What period should we evaluate as part of this audit?” That will be a conversation between you and your auditor in order to determine what the review period should be, but it is most commonly six months or 12 months. Please speak with your auditor about what is most appropriate for you and your circumstance.
