NDNB offers both SSAE 18 SOC 1 & SOC 2 audit reports – at fixed fees – for payroll companies throughout North America, and select international regions. The growth in regulatory compliance for payroll companies has ushered in yet another wave of audit demands, with many such companies choosing either the SOC 1 and/or the SOC 2 standard for service organization reporting.
Payroll companies have always been on the front line of regulatory compliance as they handle highly sensitive and confidential information, along with conducting critical batch processing initiatives for clients. Because of this, the confidentiality, integrity, and availability (CIA) of the entire payroll processing platform is what’s often tested for compliance with SOC 1 & SOC 2 audits.
NDNB also offers comprehensive SOC 1 and SOC 2 audits for businesses using Amazon AWS, Microsoft Azure, and Google GCP. And if you're using AWS for hosting of your production environment, here's what you need to know NOW about SOC 2 audits.
9 Things Payroll Companies Need to Know About SOC 1/SOC 2 Audits
With that said, it’s important that payroll companies understand the following scope considerations for such an engagement for ensuring they meet and can exceed auditor demands for a successful SOC 1 & SOC 2 audit:
1. Executive tone of management: The policies, procedures, and processes for how management “manages” the organization, effectively known as the “tone at the top”. For example, are meetings held on a regular basis, is risk assessed and analyzed often, are marketing priorities and forecasting considerations undertaken, along with many other critical management initiatives?
2. Human Resources: The policies, procedures, and processes for hiring, provisioning, and terminating users. For example, does management conduct background checks, annual employee reviews, undertake security awareness training, along with other critical HR functions?
3. Policies and Procedures: One of the most fundamentally important aspects of meeting SOC 1 and/or SOC 2 compliance for payroll companies is ensuring that all relevant policies, procedures, and processes are documented. Easier said than done as most companies fail miserably when it comes to policy development. NDNB offers a complimentary SOC 1 and SOC 2 Policy Packet for every client we engage with, ultimately saving businesses hundreds of hours and thousands of dollars in compliance costs.
4. Software development life cycle: Payroll companies utilizing their own internally developed systems and applications for payroll processing and other supporting services will undoubtedly have to include their SDLC platform within the scope of a SOC 1 and/or SOC 2 assessment. This means having highly formalized and documented Systems Development Life Cycle policies, procedures, and related processes.
5. Bath processing integrity: Data received, processed and the resulting output of such information should be valid, accurate, and complete at all times for essentially ensuring the processing integrity Trust Services Criteria (TSP) is met. Auditors will want to thoroughly review, inspect and validate all relevant integrity controls – both automated and manual – for ensuring the effectiveness of a payroll company’s internal control environment.
6. Physical security and environmental security: Protecting facilities that store organizational assets – personnel, documents, computing systems, and more – is a critical component of SOC 2 reporting for payroll companies, or any company, for that matter. Many times, payroll companies outsource their production environment to data centers and co-location facilities, for which these entities have often undertaken SOC 1 and/or SOC 2 compliance themselves.
7. Access controls: More technically known as authentication, authorization, accounting, (AAA) and auditing, access to information systems is one of the largest areas of compliance for SOC 2 assessments, or almost any type of information security audit, and for good reason. Plainly speaking, unauthorized access into critical systems by the wrong people poses huge dangers to the safety and security of organizational assets and information.
8. Network security: Yet another core area necessary for examining for SOC 1 and/or SOC 2 compliance for payroll companies is network security – one’s policies, procedures, and processes relating to firewalls, routers, intrusion detection devices, and other applicable network security initiatives. In short, auditors want to know what’s being done for protecting your network, ultimately ensuring its safety and security.
9. General Computer Operations: Activities such as incident tickets, data backups, system maintenance – and others – are essential criteria for a successful SOC 1 and/or SOC 2 audit. It means that documented and highly formalized policies, procedures, and processes need to be in place at payroll companies for such audits.
SOC 1 and SOC 2 compliance for payroll companies is essential for showcasing one’s strong internal control environment for current clients, along with providing prospects much needed assurances on the confidentiality, integrity, and availability (CIA) of sensitive data. It’s a regulatory compliance world we all live in – no question about it – so talk to the experts today at NDNB when it comes to SOC 1 and SOC 2
Call Christopher Nickell today at NDNB at 1-800-277-5415, ext. 706, or via email at This email address is being protected from spambots. You need JavaScript enabled to view it. to learn more about NDNB’s SSAE 18 SOC 1 & SOC 2 audit reports – at fixed fees – for payroll companies throughout North America, and select international regions.
