SOC 1 (SSAE 16) vs. SOC 2 (AT Section 101)|Hey, SOC 2, Where are You?

Service Organization Control (SOC) Reports, more commonly known as SOC 1, SOC 2, and SOC 3, as you may or may not be well aware of by now, represent the new framework put forth by the American Institute of Certified Public Accountants (AICPA) for reporting on controls at service organizations. 

SOC 1, is essentially tied to service organizations for which reporting is ICFR based, that is, internal controls related to financial reporting. SOC 2 and SOC 3, however, represent a sincere  and genuine attempt by the AICPA to meet the growing demands and complexities of reporting on controls for service organizations OUTSIDE that of ICFR. In essence, it's a move to correct the misguided efforts by many who used the SAS 70 standard in an incorrect manner. Will it work? Well, the early signs are not that encouraging as I've seen recent press releases for data centers and managed services entities becoming SSAE 16 "certified" or "compliant".

And by the way, the terms "certified" and "compliant" are grossly incorrect, for which you can learn more about how this has really irked the AICPA. Did they simply forget about SOC 2 and SOC 3? Are their clients simply sold on the merits of out with one standard (SAS 70), in with the new (SSAE 16), without being educated on the SOC framework? Have we as CPA's along with the AICPA not done enough to educate service organizations?

Well, I think it's a little of everything.  I'm still hopeful that this "problem" will correct itself. I can already see the technical arguments, or rather, excuses, for issuing a SSAE 16 Type 1 or Type 2 report for a data center, managed services entity, or some other cloud type infrastructure....and here they are: "Well, that's what our clients wanted, so we used the SSAE 16 standard". Or how about this one, for which I"m hearing alot of: "Hey, if the controls are "likely relevant" to ICFR, then we can issue an SSAE 16 Type 1 or Type 2".  Or, the one that takes the cake is this one: Nobody is taking SOC 2 and AT Section 101 seriously yet, so for now, I'll just fall in line and do what most other firms are doing and going right from SAS 70 to SSAE 16".