Commonly referred to as SOC 1 SSAE 18, SOC 2, and SOC 3, System and Organization Control (SOC) reports are the product of a comprehensive framework put in motion by the American Institute of Certified Public Accountants (AICPA) for reporting on controls at service organizations. Unlike its historical predecessor, Statement on Auditing Standards No. 70 (SAS 70), which was the global "de facto" reporting standard for almost any entity labeled or deemed a "service organization", the SOC framework is an internal control platform aimed at clarifying and bringing to light much needed transparency for reporting on controls at service organizations.

SOC 1 SSAE 18, SOC 2 and SOC 3 – 7 Things You Need to Know for Auditing Success

1. Define Scope: Right out of the gate, one of the most fundamentally important initiatives to tackle for SOC compliance is identifying, assessing, and confirming audit boundaries – the processes, systems, people and locations that will be assessed for compliance. Nobody likes the dreaded “scope creep” scenario, so plan accordingly and proactively, and you’ll be on your way to a highly successful audit. Without proper scoping defined – which is one of the single biggest reasons audits turn into a nightmare, and it’s why a scoping & readiness assessment is a must – your audit can quickly spiral out of control and become unmanageable.

Talk to the experts today at NDNB about performing a SOC audit and how we can correctly plan the entire engagement from beginning to end. To learn more about NDNB's wide range of reporting services and our competitive, fixed-fee pricing, contact Christopher G. Nickell, CPA, at 1-800-277-5415, ext. 706 or via email at This email address is being protected from spambots. You need JavaScript enabled to view it. today.

2. Perform a Readiness Assessment: Want to learn more about your control environment, what systems are in scope for a SOC 1 SSAE 18, SOC 2 or SOC 3 assessment? How about learning more about internal control deficiencies that require immediate attention, such as missing policies and procedures or incorrectly configured information systems? When performed by competent and knowledgeable personnel – such as NDNB – a readiness assessment becomes an incredibly valuable and useful tool for helping businesses achieve their regulatory compliance goals. It’s not just another added cost to the engagement – not at all – it’s one of the most useful and beneficial exercises that can be performed.

3. Understand the Importance of Documentation: In today’s world of regulatory compliance – regardless of what the specific mandate is, from SOC reports to PCI to HIPAA compliance, and more – one theme rings constant throughout and that’s the need for documentation. Specifically, policies and procedures, the essential documents that tell auditors how an organization performs its daily operational and I.T. task and processes. Problem is that most service organizations are woefully lacking such documentation, ultimately requiring exhaustive efforts in correcting such gaps and deficiencies. It’s why companies also turn to NDNB as we provide policy writing services for businesses.

We’ve heard stories of service organizations spending literally hundreds of hours internally – or thousands of dollars on external consultants – just for the purposes of getting ready for SOC compliance in terms of policies and procedures. That’s quite a bit of time and quite a bit of money, but the quicker, more cost-effective solution is to retain NDNB as your SOC 1, SOC 2, or SOC 3 auditors, then let us author your documentation for you.

Along with documentation needs, many service organizations will also need to perform various activities relating to system configuration enhancements, such as improving password complexity rules, creating more rigid firewall configuration rules, and much more. Just remember that there are two (2) forms of essential remediation that almost always must be performed: (1). Developing information security documentation, and (2) undertaking necessary initiatives for ensuring all critical information systems are safe and secure. NDNB offers comprehensive assistance with both policy creation and system enhancement initiatives, so contact us today to learn more about our services and solutions.

4. It’s a New World of Regulatory Compliance: Today’s digital economy is forcing business all throughout North America – and the globe – to undertake annual regulatory compliance audits and assessments. While SOC 1 SSAE 18, SOC 2 and SOC 3 compliance audits are well-known –don’t forget about PCI DSS, HIPAA, and GLBA compliance, just to name a few more frameworks. It means that now’s the time to work with a firm that has the expertise and manpower for assisting with such compliance demands, and that very firm is NDNB. Contact Christopher G. Nickell, CPA, at 1-800-277-5415, ext. 706 or via email at This email address is being protected from spambots. You need JavaScript enabled to view it..

5. Compliance is about “Continuous”: What we’re trying to tell you is that regulatory compliance is much more than just performing an annual SOC 1 SSAE 18, SOC 2, or SOC 3 audit. It’s about “continuous monitoring” and applying various efforts and initiatives for ensuring one’s internal control environment – your policies, procedures, and processes – are being assessed, maintained, and enhanced, if necessary. Long after the auditors have packed their bags and gone home, the true compliance mandates fall on your business, so it’s important to put in place all the necessary initiatives relating to “continuous monitoring”.

6. Where to Begin: Next steps for any service organization seeking to undergo annual SOC 1 SSAE 18, SOC 2 and SOC 3 audits is to talk with an expert in regulatory compliance – and that’s NDNB – so call us today to learn more. As for the steps after that, we highly recommend you kick-off your SOC compliance efforts off with a scoping & readiness assessment; a useful and proactive initiative for helping gain a greater understanding of your internal control policies, procedures, and processes – those that are critically important when it comes to the AICPA SOC framework.

7. Final Piece of Advice: Whatever CPA firm you choose in providing your business with SOC 1 SSAE 18, SOC 2 and/or SOC 3 services, make sure that they have comprehensive solutions and service in helping support the audit process from day one. Specifically, do they offer scoping & readiness assessments, along with policies and procedures writing, even assistance with technical remediation? Furthermore, do they offer fixed-fee services and discounts for multi-year offerings? NDNB does, so call and speak with Christopher G. Nickell, CPA, as he can be contacted at 1-800-277-5415, ext. 706 or via email at This email address is being protected from spambots. You need JavaScript enabled to view it..

SOC 1 vs. SOC 2 vs SOC 3

Additionally, though there are a number of defining elements in helping shape and mold the new SOC framework, it is important to note that each of the three (3) tiers of this framework are aimed at very specific needs and reporting requirements for service organizations themselves. We operate in a business environment which is in a state of constant evolution, one that has seen an exponential growth in outsourcing coupled with increasing demands for assurances from the very organizations that are performing critical functions for other entities (i.e., user organizations, user entities).

SOC 1 vs. SOC 2 vs SOC 3 – Which Report is Right for You?

As such, the following SOC reports are aimed at service organizations throughout a wide range of industries and business sectors:

SOC 1 Reports: Reporting on controls relevant to internal control over financial reporting (ICFR). Please note that SOC 1 reporting is conducted in accordance with Statement on Standards for Attestation Engagements (SSAE) No. 18, simply known as SSAE 18, along with an accompanying SSAE 18 audit guide.
SOC 2 Reports: Reporting on controls relevant to security, availability, processing integrity, confidentiality, or privacy. Please note that SOC 2 reporting are conducted in accordance with AT Section 101 and will utilize an audit guide titled Reports on Controls at a Service Organization over Security, Availability, Processing Integrity, Confidentiality, or Privacy.
SOC 3 Reports: Reporting on controls relevant to security, availability, processing integrity, confidentiality, or privacy in accordance with general Trust Service Criteria (TSC). Please note that these reports are prepared using the AICPA and the Canadian Institute of Chartered Accountants’ (CICA) Trust Services Principles, Criteria, and Illustrations for Security, Availability, Processing Integrity, Confidentiality, and Privacy.
To learn more about NDNB's wide range of reporting services and our competitive, fixed-fee pricing, contact Christopher G. Nickell, CPA. He can be contacted at 1-800-277-5415, ext. 706 or via email at This email address is being protected from spambots. You need JavaScript enabled to view it. today.