SOC 1 Archives

What is a SOC 1 Audit and Why Do You Need One?

Often times, clients might ask you to complete a SOC 1 audit, which might leave you asking, “What is a SOC 1 audit? Why does my organization need one?” If your organization has the ability to impact your customers’ internal controls over financial reporting (ICFR), then you’re likely to be asked by those customers to undergo a SOC 1 audit. But what is a SOC 1 audit exactly? A System and Organization Controls 1 (SOC 1) audit is an audit designed to test the internal controls that a service organization has implemented to protect user entities, or their customers’, data, specifically the internal controls that could impact financial reporting. SOC 1 audits are conducted in accordance with the Statement on Standards for Attestation Engagements 18 (SSAE 18), which is used to regulate how companies conduct business and report on compliance controls.

What are the Benefits of a SOC 1 Audit?

If you’re wondering “What is a SOC 1 audit?”, you’re probably also wondering “What are the benefits of a SOC 1 audit?” too. In fact, if you’ve never engaged in a SOC 1 audit before, chances are the process seems a bit intimidating. But when you pursue SOC 1 compliance with KirkpatrickPrice, it doesn’t have to be. Whether it’s your first time undergoing an audit, or you’ve been through audits before, our streamlined approach to the audit process will leave you with the following benefits upon the completion of your SOC 1 audit:

Peace of mind that your organization has the proper internal controls and processes in place to deliver high-quality services to your clients
An in-depth evaluation of your policies and procedures
Assurance for your clients that the sensitive assets they’ve entrusted with you are effectively protected
A stronger, more robust security hygiene because a third-party verified your internal controls not just your internal audit team
A competitive advantage by demonstrating your commitment to security

Has your organization been asked to demonstrate SOC 1 compliance? Are you unsure where to begin? Contact us today to learn how KirkpatrickPrice can help you get started on your compliance efforts.

More SOC 1 Resources

Understanding Your SOC 1 Report Video Series

SOC 1 Compliance Checklist: Are You Prepared for an Audit?

How to Read Your Vendors SOC 1 or SOC 2 Report?

[av_toggle_container initial=’1′ mode=’accordion’ sort=” styling=” colors=” font_color=” background_color=” border_color=” custom_class=”]
[av_toggle title=’Video Transcription’ tags=”]

A SOC 1 report is a System and Organization Controls report. Most service organizations are offering services to their clients, such as managed services, application services, or any type of third-party service that’s being outsourced to them from their clients. They’re being asked to do this report as a way to prove to the client that they’re working with that their controls are mature enough and that they’ve been tested by a third-party auditor. We’ve found that a lot of people who call us the first time, they’re small- to medium-sized service providers, and they just found out that their biggest client is requiring them to do this audit that they’ve never heard of. They feel under-the-gun and pressured to do this in order to check a box because it feels like something that’s been forced upon them. But one of the really great things as to why you should do a SOC 1 audit is because it does validate your controls; it does validate what you’re doing. You might be competing against another company in your industry that has not taken the step of having an independent third-party come in and evaluate those controls. When you have an experienced auditor, like those we have here at KirkpatrickPrice, come in with years of experience and perspective and provide you with guidance and expertise on what your controls are or are not doing, it’s a very good process for you to strengthen your environment. It’s a very healthy process to go through to have that external opinion of what you’re doing. Sometimes we have our own internal environments and we have blinders on because we’ve never had a third-party come in and look at it from a different vantage point. We find our clients telling us, “In year one when we did the audit with you, we just thought it was something we were just going to have to do and get it over with, but after years two and three, we’ve started to see that this is a very healthy process, and it actually helps our business get stronger and to grow.”

[/av_toggle]

[/av_toggle_container]

How Do You Know the Difference Between SOC 1 Type I and SOC 1 Type II?

When you begin thinking about pursuing SOC 1 compliance, you’ll have the option of choosing a Type I or Type II audit. While both of these audits assess a service organization’s controls and processes that may impact their clients’ internal control over financial reporting (ICFR), the biggest difference between SOC 1 Type I and SOC 1 Type II is the audit period. For example, if you decide to undergo a SOC 1 Type I audit, an auditor will assess your controls and processes and their impact over user entities’ ICFR for a specific moment in time. On the other hand, if your organization pursues SOC 1 Type II compliance, an auditor will assess your controls and processes and their impact over user entities’ ICFR over a minimum six-month period.

Do I Need to Start with a SOC 1 Type I or SOC 1 Type II Audit?

Determining whether you want to begin your SOC 1 compliance journey with either a Type I or Type II audit depends on your organization’s needs and what is required of you. At KirkpatrickPrice, we generally recommend that service organizations begin with a SOC 1 Type I before moving onto a SOC 1 Type II. Why? Because we want our clients to get the most out of their audit, which means that we want to set them up for success by preparing them with the tools they need to get through an information security audit. To do this, we offer a streamlined Type I process that combines our gap analysis service with a remediation project plan, resulting in the Type I audit report being delivered within weeks of the engagement kick off. By beginning with a SOC 1 Type I using this streamlined approach, service organizations can then pursue their Type II compliance with a better understanding of the audit process and more clear expectations of how a SOC 1 audit works.

Has your organization been asked to demonstrate SOC 1 compliance? Are you still unsure if you need a Type I or Type II audit? Contact us today to learn how KirkpatrickPrice can help you get started on your compliance efforts.

More SOC 1 Resources

Understanding Your SOC 1 Report Video Series

SOC 1 Compliance Checklist: Are You Prepared for an Audit?

How to Read Your Vendors SOC 1 or SOC 2 Report?

There are two types of SOC 1 reports: there’s a SOC 1 Type I report, and there’s a SOC 1 Type II report. The SOC 1 Type I report is an opinion on the fairness of the presentation of the description provided by management of the service organization, and there’s also an opinion on the suitability of the design of the controls. We also validate that the controls are in place as of a particular date. The SOC 1 Type II report has the exact same sections that I just mentioned for the Type I, but it adds on an additional section, which is testing performed by the service auditor on the operating effectiveness of the controls that are in place over a period of time. So, the Type I report cares about controls that are in place as of a particular date, whereas the Type II report cares about the operating effectiveness of those controls over a period of time. If you need help talking to an auditor about what report is right for you and what your audit period should be for your report, please contact one of our Information Security Specialists today.

[/av_toggle]

[/av_toggle_container]

What are the Components of Internal Control (CRIME)?

The framework utilized for a SOC 1 audit is known as the COSO Internal Control Framework. It’s one of the most common models used to design, implement, maintain, and evaluate internal control. To have an effective system of internal control, the COSO framework requires that service organizations have the defined components of internal control present, functioning, and supporting business and internal control objectives. Control environment, risk assessment, information and communication, monitoring, and existing control activities make up the five components of internal control, known by the acronym of CRIME.

What are the components of CRIME and what do they mean for your organization?

Control Environment: The first component of internal control is control environment. A control environment refers to a service organization’s compliance culture and includes everything from organizational structure to ethical values. Is management committed to an effective system of internal control? Is there some type of team committed to internal auditing or compliance? How does management implement policies and procedures that guide the organization? How does management create an atmosphere that addresses integrity, ethics, and operating effectiveness?

Risk Assessment: Risk assessment is a critical component of a service organization’s compliance, which is why the COSO framework incorporates it into the components of internal control. Does the organization know where assets live? Does the organization assess risks that are a threat to the achievement of internal control objectives? Are controls fully understood? Are there tests performed to assess of control?

Information and Communication: Quality information and effective communication among a service organization can impact meeting internal control objectives. When there’s a system change, how does management communicate that to internal employees and/or external users? What is the effectiveness of that communication?

Monitoring: How does management monitor the operating effectiveness of the organization? How do you address efficiencies and take part in corrective action?

Existing Control Activities: The final component of internal control is existing control activities. This is the largest component, as it provides the details about the controls that you’ve put into place to meet your internal control objectives. Does the organization have documented policies and procedures? Is there a business continuity plan? Is there a change management program?

The five components of internal control function together to create an effective system of internal control. You must have a control environment to create a compliance culture within your organization. Once you have management’s support and influence, you can create a risk assessment process that identifies and manages risks that threaten the achievement of internal control objectives. You can then implement control activities that meet your internal control objectives and use effective communication to implement these processes throughout your organization. An ongoing monitoring program will keep your organization focused on meeting internal control objectives.

To learn more about how to implement the five components of internal control at your organization, contact us today.

In order to complete your SSAE 16 (recently updated to SSAE 18), you must have the five components of internal control present and functioning. These components are known by the acronym of CRIME. The first component is a control environment. How does management implement policies and procedures that guide the organization? How does management create an atmosphere that addresses integrity, ethics, and operating effectiveness? The second component is risk assessment. Does the organization assess risks that are a threat to the achievement of your control objectives? The third component is information and communication. How does management communicate to your internal employees and your external users of your controls about any system changes or anything that might affect the use of the system that the service organization is offering. The fourth component is monitoring. How does management monitor the operating effectiveness of the organization? How do you address efficiencies and take part in corrective action? The fifth component is existing control activities. This section of the SSAE 16 (recently updated to SSAE 18) is the largest, as it provides the detail about the controls that you’ve put into place to meet your control objectives.

What is the COSO Internal Control Framework?

The framework utilized for a SOC 1 audit is known as the COSO Internal Control Framework. The COSO framework is one of the most common and important models used to design, implement, maintain, and evaluate internal control. It’s regarded as the definitive model against which organizations determine the effectiveness of their internal control.

The COSO framework was established in 1992, but updated in 2013 to address evolving technology, environments, governance, and regulations. SOC 1, 2, and 3 reports all have some type of inclusion of the COSO framework. The COSO internal control framework outlines objectives, components, and principles. What are the three objectives of COSO and why are they important?

What are the 3 Objectives of COSO?

Design, implement, maintain, and evaluate internal control – easy enough, right? There are a lot of elements that go into developing an effective system internal control. The COSO framework outlines three objectives, five components of internal control, and 17 principles related to internal control. The COSO framework defines internal control as, “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance of the achievement of objectives in the following categories: effectiveness and efficiency of operations, reliability of financial reporting, compliance with applicable laws and regulations.” The objectives of COSO integrated framework are at the very core of internal control.

What do the objectives of COSO mean for your organization?

Operations – Are the controls that your organization has put into place been properly designed and are they operating effectively? Your clients are relying on those controls as you deliver your services to them. Are your organization’s operation procedures efficient? Are your operational and financial performance goals realistic? Do you safeguard assets against risk and loss? The operations objective is meant to focus on the effectiveness and efficiency of operations.
Reporting – Are your reports reliable, timely, and transparent? What reports do your clients rely upon? Meeting the reporting objective is vital to meeting your clients’ goals and your obligations to them.
Compliance – Which laws and regulations apply to you? The compliance objective ensures that you remain in compliance with the standards and regulations that your clients care about.

To learn more about the objectives of COSO and how the internal control framework functions within your SOC 1, 2, or 3 report, contact us today.

The framework that is utilized for the SSAE 18 (formerly SSAE 16) is known as the COSO Internal Control Framework. The first objective of this framework is operations. Are the controls that you’ve put into place properly designed and operating effectively? Your clients are relying on those controls as you deliver your services to them. The second objective is reporting. What reports do your clients rely upon in order to assure that your services are meeting their goals and your obligations to them? The third objective is compliance. Which laws and regulations apply to you so that you remain in compliance with those things that your clients care about?

Sampling During a SOC 1 Audit

When an auditor performs a test of control during a SOC 1 audit, it may be appropriate to apply sampling. Sampling is applying audit procedures to less than 100% of a population. The types of populations that could need to be tested include new hire training forms, employee acknowledgements of policies and procedures, antivirus reports, or access control logs. The PCAOB states that sampling requires, “that the auditor use professional judgment in planning, performing, and evaluating a sample and in relating the evidential matter produced by the sample to other evidential matter when forming a conclusion about the related account balance or class of transactions.”

If the sample size of a population is large in number, let’s say a quantity of 100, an auditor might take a random sample of 30 in that situation. If a population size is 10 or less, they may take a minimum of three. By and large, our sample size is 10% of a population, with a maximum of 30 and a minimum of three.

More questions about SOC 1 reports? View more of our SOC 1 video resources or contact us today.

When an auditor performs a test of control for an SSAE 16 (SOC 1) report, it may be appropriate to apply sampling. If the sample size of a population is large in number, let’s say a quantity of 100, an auditor might take a random sample of 30 in that situation. If a population size is 10 or less, they may take a minimum of three. By and large, our sample size is 10% of a population, with a maximum of 30 and a minimum of three.

An example of a population that would have to be tested would be new hire training forms, employee acknowledgements of certain policies and procedures, antivirus reports, or access control logs. These kinds of things are determined by what kind of sampling could be applied in those situations where it is appropriate to do so.