Understanding Your SOC 1 Audit Report: What are Control Objectives?

What are Control Objectives and How are They Used in a SOC 1 Audit Report?

A key aspect of a SOC 1 audit report is the concept of control objectives. Control objectives are a series of statements that address how risk is going to be effectively mitigated. According to the PCAOB, “A control objective provides a specific target against which to evaluate the effectiveness of controls. A control objective for internal control over financial reporting generally relates to a relevant assertion and states a criterion for evaluating whether the company’s control procedures in a specific area provide reasonable assurance that a misstatement or omission in that relevant assertion is prevented or detected by controls on a timely basis.”

How Do You Determine Control Objectives?

There are typically 10 to 30 control objectives in a SOC 1 report, which an auditor will help you design. When scoping a SOC 1 engagement, you can create and organize a complete set of control objectives. One exercise to try is asking management to list all of the key services or activities that you, the service organization, provide to user organizations. This can help you tailor control objectives to exactly what activities you perform.

Let’s say your control objective is, “Our controls provide reasonable assurance that we restrict unauthorized access to our critical systems.” In order to achieve this control objective, your organization should implement controls in place such as locked doors, badges, monitoring systems, and logical access controls, which all restrict unauthorized access to critical systems.

If it’s your first time having a SOC 1 audit performed, we strongly recommend starting with a gap analysis of your organization’s internal controls in order to identify operational, reporting, and compliance gaps and to provide advice on strategies to manage control objectives going forward. If you have questions about SOC 1 audits or want help demonstrating to your clients your commitment to security and compliance, contact us today.

More SOC 1 Resources

Top 10 Things to Prepare You for Your SOC 1 Audit 

Everything You Need to Know About SOC 1 Audits 

3 Reasons to Stop Hesitating and Complete Your SOC 1 Audit 

Video Transcript

Part of the terminology that you will see over and over in your SOC 1 report is the concept of control objectives. The auditor will assist you in writing your control objectives. This is what you’re trying to achieve with the implementation of control.

Let me give you an example: our controls provide reasonable assurance that we restrict unauthorized access to our critical systems. You put into place controls such as locked doors, badges, monitoring systems, logical access controls. These controls have been put into place and have been designed to achieve the control objective, which is to restrict unauthorized access.

There are typically 10 to 30 objectives in a SOC 1 report, on average. These would be determined by what you do as an organization. So, our auditors would assist you in designing the way in which those control objectives are written, because those would be key parts in the SOC 1 report.

Understanding Your SOC 1 Audit Report: What is an Assertion?

What is an Assertion?

One of the things that management must provide to the auditor as part of a SOC 1 engagement is an assertion. What does that mean? What is an assertion?

In our everyday life, an assertion is a confident statement of fact or belief. In the world of auditing, assertions are still confident statements of fact or belief, but with a twist. Assertions are claims made by management regarding certain aspects of their business. An assertion is comprised of management’s description of the system that you’re providing as a service to your clients. This assertion will provide a detailed description of how the system is designed and operating, and the auditor must determine if this is fairly presented in the audit report. For a SOC 1 audit, assertions are related to a company’s financial statements.

Types of Assertions

Auditors rely upon a variety of assertions regarding a company. Assertions will fall into one of the following categories:

  • Assertions Related to Transactions – This type of assertion could be related to the occurrence of a transaction, the completeness of transactions, the accuracy in recording transactions, the cut-off date of accounting periods, and the classification of transactions.
  • Assertions Related to Account Balances – Assertions of this type focus on assets, liabilities, and equity balances at the end of a period. These assertions will be related to the existence of assets, liabilities, and equity balances at the end of a period, the completeness of the recording account balances in financial statements, the rights and obligations of the entity, and the valuation of assets, liabilities, and equity balances.
  • Assertions Related to Presentation and Disclosures – Assertions in this category highlight how information like transactions, balances, and other events are presented within financial statements. Assertions will relate to the occurrence of transactions and events disclosed in financial statements, the completeness of transactions and events disclosed in financial statements, the classification and understandability of transactions and events disclosed in financial statements, and the accuracy and valuation of transactions and events disclosed in financial statements.

Testing Assertions

Assertions must be validated by auditors during a SOC 1 engagement. If an assertion states that the salaries and wages of all employees have been accounted for, then an auditor will test to ensure this. Reviewing documentation is a major part of an auditor’s testing. An auditor, for example, might follow your organization’s procedure for checking the occurrence of transactions. If the result of the procedure doesn’t match the assertion, this is an issue.

More questions about SOC 1 audits? Want help demonstrate to your clients your commitment to security and compliance? Contact us today.

Video Transcript

One of the things that management must provide to the auditor as part of a SOC 1 engagement is an assertion. The assertion is comprised of management’s description of the system that you’re providing as a service to your clients. This assertion will provide a detailed description of how the system is designed and operating, and the auditor must determine if this is fairly presented in the audit report.

Will I Pass a SOC 1 Audit? What if I Fail The Audit? Reasonable Assurance Explained

Organizations put valuable resources into completing SOC 1 audits: time, money, people, technology, and more. We know that often times, a SOC 1 audit can make it or break it for our clients’ business and we don’t take that lightly. When someone asks us, “Will I pass a SOC 1 audit? What if I fail the audit? What happens if I fail?”, we want to give them the best explanation we can in regards to reasonable assurance.

Reasonable Assurance Explained for SOC 1 Audits

When explaining reasonable assurance, there’s one important lesson to understand: SOC 1 audits do not work on a pass/fail system. The purpose of a SOC 1 report is to provide user entities reasonable assurance that their controls relevant to internal controls over financial reporting (ICFR) are suitably designed and operating effectively. Instead of passing or failing your organization, an auditor will issue a qualified or unqualified opinion. Understanding reasonable assurance changes your mindset from, “What if I fail the audit? Will I pass the audit?” to “How would an auditor assess these controls?”

If an auditor determines that a control was not in place or effective, then a qualified opinion would be issued. This would sound something like, “Except for Control X, reasonable assurance is there. The controls have been suitably designed and operating effectively.” An unqualified opinion means there are no qualifications or significant exceptions being issued and reasonable assurance has been determined.

Understanding the concept of reasonable assurance can help you approach SOC 1 audits in a healthy way. Instead of asking, “Will I pass a SOC 1 audit? What if I fail the audit?”, you can look at your organization’s controls and ask, “Would an auditor see that these controls are suitably designed? Are they operating effectively? Would we achieve reasonable assurance?”

If it’s your first time having a SOC 1 audit performed, we strongly recommend starting with a gap analysis of your organization’s internal controls in order to identify operational, reporting, and compliance gaps and to provide advice on strategies to manage control objectives going forward. If you have questions about SOC 1 audits or want help demonstrating to your clients your commitment to security and compliance, contact us today.

 

Video Transcript

One of the questions that we get all the time is: will I be able to pass the audit? What if I fail the audit? The SSAE 16 (now SSAE 18) does not work on a pass/fail system. It works on a threshold of reasonable assurance. The auditor will issue an opinion about whether or not the controls are suitably designed and operating effectively during a period of time.

An unqualified opinion means that there are no qualifications or opinions being issued and reasonable assurance has been determined. Whereas a qualified opinion would be an opinion where there are some qualifications to that opinion. For example, “Except for this or that, reasonable assurance is there. The controls have been suitably designed and are operating effectively.”

Understanding the concept of reasonable assurance is good way to approach your audit so that you can understand if an auditor can achieve reasonable assurance when they look at your controls and determine if they’re operating effectively.

Do I need a SOC 1 Type I or a SOC 1 Type II Report?

When considering having a SOC 1 audit performed, there are two different report options available. Knowing whether you need a SOC 1 Type I or a SOC 1 Type II report will depend on your client’s needs and timing constraints.

What’s the difference between a SOC 1 Type I and a SOC 1 Type II report?

A SOC 1 Type I and a SOC 1 Type II both report on the controls and processes at a service organization that may impact their user entities’ internal control over financial reporting. The main difference to note is that a SOC 1 Type I report is an attestation of controls at a service organization at a specific point in time, whereas a SOC 1 Type II report audits controls at a service organization over a period of time (minimum six-month period) in order to attest to the operating effectiveness of the controls.

Do I need a SOC 1 Type I or a SOC 1 Type II Report?

If your client has requested a SOC 1 report from you but doesn’t require a specific type, how do you determine whether you need a SOC 1 Type I or a SOC 1 Type II report? If it’s your first time going through a SOC 1 audit, we commonly advise clients to begin with a Type I and then move to a Type II the following audit period. SOC 1 Type I reports are less constraining than a SOC 1 Type II report. SOC 1 Type I reports also give you the opportunity to work with your auditor on designing controls and ensuring that the description of controls would be fair and accurate in the report.

If you’re required to receive a SOC 1 Type II report, additional testing is necessary to determine that the controls are not only in place, but also operating effectively over a period of time. SOC 1 Type II audits take more time to conduct because you’re looking at controls over a period of time.

It’s important to consider these factors, client needs, and timing constraints, when trying to decide if you need a SOC 1 Type I or a SOC 1 Type II report. If you have questions about which type of SOC report you need or want help demonstrating to your clients your commitment to security and compliance, contact us today.

Video Transcript

The type of report that you should receive for your SSAE 16 (now SSAE 18), many times is determined by what your client is asking you to do. Sometimes your request from your client will be an SSAE 18 report, period. There are two types of reports. There’s a Type I and a Type II. If you’ve never done an SSAE 18 report before, it’s a good idea to begin in the first year with a Type I report. If your client is not requiring you to constrain to the Type II report, a Type I report gives you the opportunity to work with the auditor on designing your controls and ensuring that the description of your controls would be fair and accurate in the report. That’s the threshold for a Type I report.

If they are requesting you to do a Type II report, there is additional testing that must take place from the auditor in order to determine that the controls are not only in place, but also operating effectively over a period of time. A Type I is a good place to start because you’re able to address the design and description of the controls as of a certain date, whereas a Type II report takes a little bit more time to conduct because you have to look at those controls having been in place over a period of time. Please consider those factors as you determine if you need a Type I or Type II SSAE 18 report.

 

What is a SOC 1 Audit and Why Do I Need One?

Have you had a client tell your organization that it needs to have a SOC 1 audit performed? If your immediate reaction was, “What is a SOC 1?”, that’s completely normal. You’re in the right place!

Have you ever had your boss ask you “What is a SOC 1 audit?” and need a project timeline as soon as possible? You’re also in the right place! Have you seen competitors announce their compliance and wondered, “What is a SOC 1 and why is the competition pursuing one?” Don’t worry, we’ll cover that, too. Let’s answer three basic questions about SOC 1 audits:

  • What is a SOC 1?
  • Why do I need a SOC 1?
  • What are the benefits of a SOC 1?

What is a SOC 1 Compliance Audit?

A Service Organization Control 1 (SOC 1) engagement is an audit of the internal controls (policies, procedures, and technologies) which a service provider has implemented to protect client data. SOC 1 audits are performed in accordance with the Statement on Standards for Attestation Engagements No. 18 (SSAE 18). SOC 1 reports were primarily designed to report on the controls of service organizations that are relevant to their client’s financial statements. SOC 1 audits are intended to aid service organizations in eliminating potential errors to client information and ensuring efficiency in their controls.

We most commonly perform a SOC 1 for small to medium-sized service providers who deliver managed services, application services, or any type of third-party service. Now that we’ve figured out what a SOC 1 is, the next thing to consider is: why do I need a SOC 1?

Why do I need a SOC 1?

If you’ve ever asked, “What is a SOC 1?” then you’ve probably also wondered, “Why do I need a SOC 1?” Let’s say your organization is a service provider, providing payment processing services. Why would you need a SOC 1? SOC 1 engagements are designed specifically for service providers. If you provide payment processing services to clients, your service organization may need a SOC 1 because you could potentially impact clients’ financial statements. Your service organization may need a SOC 1 report because your client or regulatory body is requesting it, or maybe because you’re being proactive with information security and compliance.

A SOC 1 report demonstrates to your clients that you take the security of sensitive data seriously. You’ve hired a third-party auditing firm to validate your controls are suitably designed and operating effectively, you’re gaining assurance, you’re maturing your environment – all things that assure your clients that their sensitive information is being handled in accordance with their expectations and with SSAE 18.

Culture of Compliance

We see many service organizations initially engage in an audit, like a SOC 1, because it’s something they are required to do by a client or regulatory body. An audit can be costly, time-consuming, and confusing – we know. So when something like a SOC 1 audit is forced on an organization, it can create a negative outlook on the entire auditing process. This attitude towards compliance makes organizations reluctant to give the audit their full effort or attention. Because a SOC 1 audit deals with something as important as internal control over financial reporting, it’s vital that the engagement receives the full attention it deserves.

We believe that the best-kept industry secret to achieving compliance success is creating a culture of compliance within your organization. Compliance isn’t a quick fix to all of your security needs; it’s a constant cycle of improvement. Audits are healthy for any organization. They help you see how you can grow and mature. After two or three years of audits, our clients come to appreciate the advantages that an audit brings.

The Benefits of a SOC 1 Audit

A SOC 1 audit can bring so many benefits to your company, especially if a culture of compliance has been created. The top six benefits of a SOC 1 include:

  • Verifying that your organization has the proper internal controls and processes in place to deliver high quality services to your clients.
  • Evaluating your policies and procedures, which are crucial to the operability of your organization.
  • Assuring clients that their sensitive data is protected, building trust between service providers and user organizations.
  • Removing the internal blinders; personnel often can’t or don’t want to see vulnerabilities that an experienced auditor does.
  • Strengthening your environment, and teaching you ways to mature your practices.
  • Giving you a competitive advantage by demonstrating your commitment to security.

View more SOC 1 compliance resources.

Video Transcription

The SSAE 16 (now SSAE 18) is a Service Organization Control Report. Most of the service organizations that we audit are small to medium size service providers who are delivering managed services, application services, or any type of third party or outsourced service that a client has hired you to do. I’ve found that clients initially do this audit because they’re being required to do it, they’re being forced to do it, but later on in the process, they come to appreciate what an audit does for them.

An audit is very helpful to you as a small to medium size service provider because it helps you to validate what you’re doing, it helps you to see whether or not the controls that you’ve put into place are effective, and it’s a very valuable resource for an experienced auditor to review you without the blinders that sometimes we have on internally. When an external auditor comes in, they’re able to bring their experience and perspective to your environment and controls and provide you with very valuable guidance and recommendations to strengthen your environment. We’ve had clients who’ve been working with us for three or more years say, “The first year, I didn’t want to do it. It was just a task that we had to do.” But after year two and three, they start to see that an audit is very helpful and healthy for an organization to receive that validation and recommendations about how they can mature in their practices.