SOC 2 Compliance Services: Internal Control Reporting

If your company is a vendor to other companies and provides software, data processing services, or a function that has access to non-public customer data, you’ve likely been asked to provide a SOC 2 audit report.

A SOC 2 audit requires service organizations to establish and follow strict information security, integrity, and availability policies and procedures surrounding their services and systems. SOC 2 reports are based on the AICPA Trust Services Criteria (TSC), and five different categories where the service organization identifies and maps individual controls to meet the underlying criteria. The audit report helps to provide your customers with assurance that your company has established and follows leading practices for protecting and managing your service commitments and system requirements.

Depending on the scope of the engagement, organizations may pursue SOC 2 Type I or SOC 2 Type II compliance based on customer, regulatory and contractual requirements.

Organizations are strengthening vendor management and security requirements for third-party service providers handling customer data. Any organization that provides services that involve the collection, storage, processing or transmission of information received from customers must ensure that its internal controls are secure. This includes any and all information technology and business process controls that touch customer data. As a result, SOC 2 compliance has become a standard expectation during security reviews, vendor due diligence and contract renewals. A SOC 2 report helps organizations demonstrate that appropriate controls are in place to protect systems and sensitive information. It also provides customers, auditors and stakeholders with greater visibility into how risks are managed across people, processes and technology. During contract renewals, organizations without a current SOC 2 report may face increased scrutiny or risk losing opportunities to vendors that can demonstrate audit-ready controls.

If you’ve been asked to provide a SOC 2 report as part of customer due diligence or vendor requirements, contact a Withum SOC specialist to discuss your compliance goals.

The SOC 2 framework is built on five Trust Services Criteria, established by the American Institute of Certified Public Accountants (AICPA):

1. Security
2. Availability
3. Processing integrity
4. Confidentiality, and
5. Privacy

Security is the only mandatory criterion for a SOC 2 report, while the remaining categories are optional depending on the service being provided to customers. The SOC 2 is a restricted use report that can only be distributed to existing customers and their auditors.

The right report type depends on the organization’s maturity, customer requirements and the level of assurance stakeholders expect.

Like the SOC 1 report, there are two types of SOC 2 audits – the SOC 2 Type I and the SOC 2 Type II report.

• SOC 2 Type 1 Audit Report
  This report describes a vendor’s systems and whether or not their design is suitable to meet relevant AICPA trust services criteria.
• SOC 2 Type 2 Audit Report
  The SOC 2 Type 2 audit is extremely comprehensive, and in addition to suitability of design, it details the operational effectiveness of the controls within the vendor systems described in the Type I report.

In order to get a SOC 2 audit report, you’ll need to engage with an AICPA approved, independent CPA. Withum has a team of SOC specialists that are trained and well-versed in the intricacies of SOC 2 compliance and the needs of our clients. To discuss your SOC 2 report needs with one of Withum’s SOC Specialists, contact us online.