Expanding Service Organization Controls Reporting: SOC 2 Reports Offer CPAs New Opportunities to Address Clients' Needs
EXECUTIVE SUMMARY * CPAs have an opportunity to expand their attestation services through a new SOC report. * SOC 2 engagements are designed to meet the needs of service organization users and other stakeholders. They provide organizations that outsource tasks and functions a mechanism for improving governance and oversight of service providers. They also enable service organizations to communicate the suitability of the design and operating effectiveness of their controls through a widely accepted reporting format. * There are two types of SOC 2 reports. Type 1 reports provide a description of a service organization's system and a CPA's opinion on the fairness of the description and the design of the service organization's controls. Type 2 reports also add the CPA's opinion on the operating effectiveness of controls. * CPAs in public practice who are familiar with reports performed using SAS no. 70 and SSAE no. 16 are well-positioned to accept SOC 2 engagements to meet their clients' needs. However, there are some unique factors a service auditor must consider first, such as whether the period of the report is sufficient to meet the needs of users and sufficient for the service auditor to form an opinion on the operating effectiveness of the controls that meet the applicable Trust Services criteria, among others. ********** [ILLUSTRATION OMITTED] Several prominent internal control breakdowns and increased focus on internal control by regulators, boards of directors and others charged with governance have led to increased demand for attestation reports on controls over subject matter other than financial reporting provided by an independent CPA. Neither Statement on Auditing Standards (SAS) no. 70, Service Organizations, nor the new standard that replaced 5AS no. 70, Statement on Standards for Attestation Engagements (SSAE) no. 16, Reporting on Controls at a Service Organization, is intended to address controls relevant to these risks. In response to this demand, the AICPA has developed the Service Organization Control (SOC) reporting framework. The framework is designed to help service organizations, their customers and CPAs understand the types of examination reports a CPA can issue related to service organization controls. The AICPA also has published new guidance for attestation reports to help meet this growing demand for internal control reporting. The SOC (commonly pronounced "sock") framework includes three reporting options. This article focuses on SOC 2 reports and engagements and provides some additional information on SOC 3 engagements. SOC 1 engagements are performed in accordance with SSAE no. 16 and focus solely on controls at a service organization that are likely to be relevant to an audit of a customer's financial statements. SOC 2 engagements are performed in accordance with AT section 101, Attest Engagements, using the guidance provided in the Guide Reporting on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (SOC 2) (the SOC 2 Guide). A SOC 2 engagement is designed to provide: * Organizations that outsource tasks and functions a mechanism for improving governance and oversight of service providers. * Service organizations the ability to communicate the suitability of the design and operating effectiveness of their controls through a widely accepted reporting format. * CPAs an opportunity to expand their attestation services through a new report that meets a marketplace need. SOC 2 reports provide users with: (1) A detailed description of a service organization's system, including controls designed to achieve the criteria for one or more of the Trust Services principles. A Trust Services report for service organizations is performed under AT section 101 using TSP section 100, Trust Services Principles, Criteria, and Illustrations for Security, Availability, Processing Integrity, Confidentiality, and Privacy. …