Learn essential SOC 1 SSAE 18 compliance and SOC 2 compliance best practices from North Amercia’s auditing experts at NDNB.
SOC 1 SSAE 18 compliance and SOC 2 compliance is becoming a must-have for tens of thousands of businesses seeking to comply with growing client demands and industry specific regulations. Whatever your business offers, from I.T. services to operational and manufacturing of products, it seems as if the regulatory compliance mantra is sparing hardly any company today in North America.
What’s interesting to note is that while the U.S. is the unquestioned leader for financial and IT markets, the mandates for compliance have increased similarly also. The economy is growing like never before – and that’s great – but so are the massive compliance mandates of SOC 1 SSAE 18 compliance and SOC 2 compliance.
What Businesses Need to Know about SOC 1 & SOC 2 Audits
Want to become SOC 1 SSAE 18 and/or SOC 2 compliant without having to spend thousands of needless dollars and dozens of additional operational hours? If so, then take note of the following compliance best practices for businesses:
1. It all starts with a Scoping & Readiness Assessment:
Do you have a clear understanding of the road ahead for SOC 1 SSAE 18 compliance and SOC 2 compliance, particularly the milestones and associated deliverables? Have you taken the time to asses and remediate deficiencies within your internal control environment, such as processes and procedures and other technical constraints? Have you determined what the actual audit scoping boundaries are, the personnel to be involved in the SOC 1 SSAE 18 compliance and SOC 2 compliance assessment process, and other critical issues?
If not, it’s time to perform a much-needed SOC 1 & SOC 2 scoping & readiness assessmentreadiness assessment, an invaluable exercise for helping ensure the long-term success of your audit. Spending a few extra hours on the front-end of the audit will pay huge dividends in helping deliver an audit report on time and within budget. To learn more about NDNB’s scoping & readiness activities for businesses throughout North America, contact Christopher Nickell, CPA, at This email address is being protected from spambots. You need JavaScript enabled to view it., or call him directly at 1-800-277-5415, ext. 706.
2. What’s the ICFR?
The ICFR concept – commonly known as Internal Controls over Financial Reporting – essentially focuses on internal controls related to financial reporting, something that the now defunct SAS 70 auditing standard was originally intended for. For service organizations that provide services to their clients that could impact financial reporting for such clients, then the ICFR component is to be assessed within the scope of a SOC 1 SSAE 18 report.
For example, if you as a service organization are performing material financial calculations for medical expenses that have to be paid out by your clients to their clients, then an auditor would want to assess the financial controls related to how you as a service organization performs those calculations. In essence, any type of function performed by a service organization for their clients that is financial in nature and can impact another businesses’ financial reporting, ultimately brings in the ICFR component into auditing, which means having a SOC 1 SSAE 18 audit performed and not a SOC 2. SOC 2 audits are generally geared towards technology companies such as data centers, cloud computing, managed service providers, and others.
3. Why the Growth in SOC 2 Audits?
Simple, information technology is growing by leaps and bounds, and with that, a due-diligence auditing mechanism is needed for assessing and testing internal controls for many of today’s tech sector companies, thus enter SOC 2. Add to the fact that the U.S. tech sector is witnessing huge growth in recent years, the SOC 2 auditing mechanism is now becoming a strict mandate for many technology firms in North America.
As the country’s economy continues to grow, so will the regulatory compliance mandates, especially SOC 1 SSAE 18 compliance and SOC 2 compliance. In fact, the growth in SOC 2 audits is now outpacing that of SOC 1 audits, something that wasn’t the case back in 2011 when the new AICPA framework was launched. Sure, there are still technology companies performing SOC 1 audits – we don’t think it’s the correct assessment, in our professional opinion – so hopefully more entities will make the switch to SOC 2 audits once they clearly see the benefits.
4. Technical Remediation is Necessary.
Sure, processes and procedures and other forms of documentation are vitally important for both SOC 1 SSAE 18 compliance and SOC 2 compliance, but so is the ability to remediate technical controls. Often times, service organizations will need to strengthen password parameters, employ additional server configuration and hardening procedures, implement vulnerability scanning services, and much more. After all, what good is documentation if they does not reflect the actual technical/security changes that need to take place?
A competent auditor can help assess your technical controls, while also providing meaningful feedback on items deemed necessary for remediation. The process “can” be a time-consuming one, it all depends on the maturity of your controls, the willingness to make the changes, and what resources you have for assisting in such endeavors.
5. Audits are an Annual Process.
Yes, they are, so welcome to the world of regulatory compliance because it is here to stay. This means it’s important to find a well-qualified, highly competent CPA and advisory firm to become your trusted partner, and that’s NDNB. Contact Christopher Nickell, CPA, at This email address is being protected from spambots. You need JavaScript enabled to view it., or call him directly at 1-800-277-5415, ext. 706.
NDNB is North America’s leading provider of high-quality, fixed fee pricing audits and assessment for SOC 1 SSAE 18 compliance and SOC 2 compliance. Atlanta is the world headquarters of NDNB, a globally recognized CPA firm providing a wide array of regulatory compliance services in accordance with the AICPA SOC reporting framework.
Today’s growing cybersecurity threats and issues have raised the bare for regulatory compliance, one that’s forcing companies to undergo annual SOC 1 SSAE 18 compliance and SOC 2 compliance. The solution for easing the compliance headache is simply talking to the experts at
SOC 1 SSAE 18 compliance and SOC 2 compliance – Fixed-Fees
With years of experience working with a wide variety of business sectors – from agriculture to manufacturing, information and cyber security – just to name a few – NDNB has the audit “know-how” and deep bench for providing an efficient, high-quality, yet competitively priced SOC 1 SSAE 18 compliance and SOC 2 compliance assessment – from beginning to end.
NDNB also offers comprehensive SOC 1 and SOC 2 audits for businesses using Amazon AWS, Microsoft Azure, and Google GCP.
From readiness assessment to pen testing, along with conducting the actual SOC 1 SSAE 18 compliance and SOC 2 compliance audits, NDNB’s lockstep audit process has been refined and fine-tuned for more than a decade. Contact Christopher, G. Nickell, CPA, at 1-800-277-5415, ext. 706, to learn more, or email him at This email address is being protected from spambots. You need JavaScript enabled to view it..
