Assurance and Advisory Services

    Users and User Entities  

    Many companies function more efficiently and profitably by outsourcing tasks or entire functions to service organizations that have the personnel, expertise, equipment, or technology to accomplish these tasks or functions. Examples of  such services include cloud computing, managed security, health care claims management and processing , sales force automation etc. Although user management  can delegate these tasks or functions to a service organization, they are usually held responsible by those charged with governance (for example, the board of directors), customers, shareholders, regulators and other affected parties for establishing effective controls over those outsourced functions. The following SOC reports provide user management with the information they need about the service organization’s controls to help assess and address the risks associated with an outsourced service:

    SOC 1SM Report
    Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting These reports, prepared in accordance with Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization, are specifically intended to meet the needs of the of entities that use service organizations (user entities) and the CPAs that audit the user entities’ financial statements (user’ auditors), in evaluating the effect of the controls at the service organization on the user entities’ financial statements. Use of these reports is restricted to the management of the service organization, user entities, and user auditors.

    SOC 2SM Report— Report on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy
    These reports are intended to meet the needs of a broad range of users that need information and assurance about the controls at a service organization that affect  the security, availability, and processing integrity of the systems the service organization uses to process users’ data and the  confidentiality and privacy of the information processed by these systems. These reports can play an important role in:  

    • Oversight of the organization
    • Vendor management programs
    • Internal corporate governance and risk management processes
    • Regulatory oversight

    Use of these reports is generally restricted.  

    SOC 3SM Report— Trust Services Report for Service Organizations These reports are designed to meet the needs of users who need assurance about the controls at a service organization that affect the security, availability, and processing integrity of the systems used by a service organization to process users’ information, and the confidentiality, or privacy of that information, but do not have the need for or the knowledge necessary to make effective use of a SOC 2 Report. These reports are prepared using the AICPA/Canadian Institute of Chartered Accountants (CICA) Trust Services Principles, Criteria, and Illustrations for Security, Availability, Processing Integrity, Confidentiality, and Privacy.  Because they are general use reports, SOC 3 reports can be freely distributed or posted on a website as a SysTrust for Service Organizations seal.

     

     

    SOC 2 User Guide 

    AICPA and ISACA have jointly released  the SOC 2 User Guide for Report on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy,  to provide user entities with the information they need when interpreting the SOC 2sm reports received from service organizations.  The guide is intended for those evaluating a service organization’s SOC 2sm report as part of a governance, risk and compliance (GRC) program; vendor assessment; security evaluation; business continuity plan or other control evaluation. It may also be useful to those considering requesting a SOC 2sm report from an existing vendor that does not currently provide a report or a new vendor as part of the due diligence or request for proposal (RFP) process. For information on SOC 2 User Guide, visit www.isaca.org/SOC2.

    Additional Resources 

    Understanding How Users of Service Organizations Would Make Use of a SOC 2sm Report, provides guidance to users entities on the factors they should consider when evaluating the relationship of the controls being reported on in the SOC 2sm report to their environment. Examples of outsourced services include cloud computing, managed security, customer support etc.
    Copyright © 2006-2014 American Institute of CPAs.