Understanding Your SOC 1 Report

Your service organization may need a SOC 1 report because your client or regulatory body is requesting it, or maybe because you’re being proactive with information security and compliance. A SOC 1 report will demonstrate to your clients that you take the security of sensitive data seriously because you’ve hired a third-party auditing firm to validate your controls, you’ve gained assurance, you’ve matured your environment – all things that assure your clients that their sensitive information is being protected.

There’s a lot to understand about a SOC 1 report, though. If you feel overwhelmed but want to educate yourself on SOC 1 audits, these videos will empower you to understand your SOC 1 report. Joseph Kirkpatrick will walk you through components such as scoping, gap analysis, choosing an audit period, sampling, control objectives, assertions, and more. Choose a video below to begin learning.

View all SOC 1 Videos

Featured Episode:

Understanding Your SOC 1 Report: The 5 Components of Internal Control

March 20, 2018/in SOC 1, Video /by Joseph Kirkpatrick

The framework utilized for a SOC 1 audit is known as the COSO Internal Control Framework. It’s one of the most common models used to design, implement, maintain, and evaluate internal control. To have an effective system of internal control, the COSO framework requires that service organizations have the defined components of internal control present, functioning, and supporting business and internal control objectives. Control environment, risk assessment, information and communication, monitoring, and existing control activities make up the five components of internal control, known by the acronym of CRIME.

Understanding Your SOC 1 Report: The 3 Objectives of COSO

March 12, 2018

Design, implement, maintain, and evaluate - there’s a lot of elements that go into developing an effective system internal control. The COSO framework is regarded as the definitive model against which organizations determine the effectiveness of their internal control. The objectives of COSO are at the very core of internal control. What do the objectives of COSO mean for your organization?

Understanding Your SOC 1 Report: How Does Sampling Work?

January 31, 2018

When auditor performs a test of control during a SOC 1 audit, it may be appropriate to apply sampling. Sampling is applying audit procedures to less than 100% of a population. The types of populations that could need to be tested include new hire training forms, employee acknowledgements of policies and procedures, antivirus reports, or access control logs.

Understanding Your SOC 1 Report: Auditor's Test of Controls

January 24, 2018

The test of controls are procedures that the auditor goes through to provide reasonable assurance that the controls have been operating effectively over a period of time. When reviewing a SOC 1 Type II report, the opinion and the results of the auditor’s test of controls may contain vital information necessary to verify whether a service organization’s controls have been suitably designed and are operating effectively.

Understanding Your SOC 1 Report: Audit Risk, Control Risk, and Detection Risk

January 16, 2018

An information security audit is largely driven by risk. We know that your clients rely upon our opinion; we don’t take that lightly. We will do everything possible to gain reasonable assurance that controls are in place and operating effectively. This is why audit risk, control risk, and detection risk are so important to us. These elements of risk overlap and work together, but they also drive our audits so that we can give you reasonable assurance.

Understanding Your SOC 1 Report: Determining your Audit Period

January 10, 2018

When considering pursuing a SOC 1 Type II report, there’s a new element to consider: what period should we evaluate? It’s important to remember that a SOC 1 Type I and a SOC 1 Type II both report on the controls and processes at a service organization that may impact their user entities’ internal control over financial reporting.

Understanding Your SOC 1 Report: What is Scope?

January 3, 2018

No matter what kind of data you’re protecting – financial information, cardholder data, ePHI – you need to understand where your assets reside and what controls are protecting them. This is why scoping is so important If you don’t know where your data is, how do you plan to protect it?

Vendor Compliance Management: Carve-Out vs Inclusive Method

December 18, 2017

As you're preparing your service organization for a SOC 1 audit, you must identify your vendors and third parties, what services they provide, and whether or not they have completed third-party audits themselves. How do you handle outsourced services when scoping your SOC 1 audit report? Watch this short video to learn more about utilizing the carve-out method or the inclusive method in your SOC 1 engagement.

Understanding Your SOC 1 Report: What is a Gap Analysis?

December 11, 2017

If it’s your first time going through an audit, KirkpatrickPrice strongly recommends completing a gap analysis. A gap analysis is designed to prepare organizations for an audit, is a process of discovery, a chance to find areas of weakness, and an opportunity to gain industry insights. Watch this short video to learn more about the specifics of a gap analysis and how it can help you prepare for your audit.

Understanding Your SOC 1 Audit Report: What is an Assertion?

November 15, 2017

One of the things that management must provide to the auditor as part of a SOC 1 engagement is an assertion. What does that mean? What is an assertion? In our everyday life, an assertion is a confident statement of fact or belief.

Will I Pass a SOC 1 Audit? What if I Fail The Audit? Reasonable Assurance Explained

September 29, 2017

Organizations put valuable resources into completing SOC 1 audits: time, money, people, technology, and more. We know that often times, a SOC 1 audit can make it or break it for our clients’ business and we don’t take that lightly. When someone asks us, “Will I pass a SOC 1 audit? What if I fail the audit? What happens if I fail?”, we want to give them the best explanation we can in regards to reasonable assurance.

Do I need a SOC 1 Type I or a SOC 1 Type II Report?

September 22, 2017

There are two reports options when considering a SOC 1 audit. When trying to decide whether you need a SOC 1 Type I or a SOC 1 Type II report, it comes down to your client's needs and timing constraints.

What is a SOC 1 and Why Do I Need One? The Benefits of a SOC 1

What is a SOC 1 Audit and Why Do I Need One?

September 15, 2017

Have you had a client tell your organization that it needs to have a SOC 1 audit performed? If your immediate reaction was, "What is a SOC 1 audit?" that's completely normal. You're in the right place! A Service Organization Control 1 (SOC 1) engagement is an audit of the internal controls (policies, procedures, and technologies) which a service provider has implemented to protect client data.