California service organizations are often being required to undergo annual SSAE 18 SOC 1 compliance assessments, forcing such entities to spend considerable time and money with one of today’s most demanding and operationally taxing audits. From San Diego to Sacramento, NDNB offers highly experienced audit and compliance services for SSAE 18 SOC 1 audits, along with SOC 2 reporting, and numerous other solutions and services for today’s demanding and complex compliance mandates.

SSAE 18 SOC 1 Roadmap for California Businesses

Looking to gain a stronger understanding of critical steps to take and subject matter you need to know about for ensuring an audit that’s delivered on time and within budget? NDNB offers the following roadmap for helping ease the pain and costs associated with regulatory compliance with the AICPA System and Organization Controls (SOC) framework:

Get in the Mindset: Compliance can often be a mundane, time-consuming, and taxing exercise for California businesses, as this is one of the country’s most highly regulated economies. Add to the mix of growing security compliance mandates – such as SSAE 18 SOC 1 and SOC 2 audits – and its’ easy to see how this can start to get extremely frustrating.

As for SSAE 18 SOC 1 compliance, the real key for auditing efficiency, reduced fees and expenses and minimal business interruption is to conduct a readiness assessment – a useful exercise that clearly defines audit scope and identifies missing gaps and other critical issues. It means changing your mindset about audits and conducting an SSAE 18 SOC 1 readiness assessment for long-term value.

When properly performed, a SOC 2 scoping & readiness assessment successfully identifies critical gaps, weaknesses, and other control issues relevant to a service organization’s internal controls. Specifically, California businesses need to be aware of audit pitfalls, challenges, and what initiatives need to be put in place for ensuring a successful SOC 2 audit, this year, and many years forward. Compliance is here to stay, thus it’s important to properly assess and correct all gaps identified during a SOC 2 scoping & readiness assessment.

ICFR: What’s ICFR, it stands for “Internal Controls over Financial Reporting”, and if you, as a service organization, offer services to clients that can impact their financial reporting, these services – and their supporting internal controls – should be included within the scope of an SSAE 18 SOC 1 assessment.

There’s a fork in the road when it comes to SOC compliance, with SOC 1 being the preferred assessment for ICFR control environments, and SOC 2 for technology-oriented service organizations. Call and speak with Christopher Nickell, CPA, at 1-800-277-5415, ext. 706, to learn more about the ICFR concept and SSAE 18 SOC 1 reporting.

Remediation: Want to complete your SSAE 18 SOC 1 audit successfully – on time and within the prescribed budget – then remember to plan for remediation. Specifically, it’s important to know that Southern California service organizations can expect to spend time developing policies and procedures, along with strengthening a number of internal controls for ensuring a successful audit. It can take some time, but NDNB is there every step of the way with you, providing our hands-on expertise. We’ve been helping Southern California businesses for years with SSAE 18 SOC 1 compliance, so contact Christopher G. Nickell, at 1-800-277-5415, ext. 706 today, or vial email at This email address is being protected from spambots. You need JavaScript enabled to view it..

Create an Asset Inventory: What’s an asset inventory, it’s a comprehensive listing of all your information systems deployed in a production environment, and may also include a list of development systems. Hey, you cannot protect what you don’t know you have, so ensuring that both you and the auditors have a complete list of all information systems is critical – from a best practices perspective, and for the success of the audit.

Here’s what you should have a complete list of: network devices, such as firewalls, switches, routers, along with entire inventory of all servers, both physical and virtual servers, along with a listing of the operating systems and applications running on them. And remember, an asset inventory list also helps with other compliance mandates, such as PCI DSS and HIPAA reporting.

What’s more, remediating missing and inconsistent policies and procedures – while incredibly important – means nothing if the newly developed procedures are not even put in place. This requires a true commitment from the service organization going forward, one that speaks to the importance of regulatory compliance in today’s world. NDNB can help in this endeavor, as we have real-world experience in working with California businesses from San Diego to Sacramento.

Audit Procedures: Curious as to what goes on during an SSAE 18 SOC 1 audit? It’s about collecting documents for validating the existence of internal controls, which means providing NDNB with policies and procedures, screenshots, and forms of audit evidence. Additionally, we tour certain facilities, ask questions, get signed memos, and more. Sound overwhelming – it’s not – because NDNB has an incredibly efficient process that works very well from day one. With helpful online tools and auditors that truly care, you’ll be SSAE 18 SOC 1 compliant in no time at all.

Audit Report: The final product delivered to the actual service organization undertaking SSAE 18 SOC 1 compliance is an actual Service Auditor’s Report, and no, you are not SSAE 18 and/or SOC 1 “certified”, nor do you receive a plaque or certificate! There is no such thing as being “certified” – you are simply being assessed jointly against the SOC 1 framework and the SSAE 18 professional standard, nothing more.

NDNB – Providers of Fixed-Fee SOC 1 and SOC 2 Audits

Why spend unnecessary time, money and activities on SSAE 18 SOC 1 compliance when the experts for regulatory compliance are right in your backyard? NDNB has proven itself many times over in Southern California as the “go-to” firm with great pricing and services, so contact Christopher G. Nickell, at 1-800-277-5415, ext. 706 today, or vial email at This email address is being protected from spambots. You need JavaScript enabled to view it.. From SOC 1 audits to SOC 2 compliance, HIPAA, PCI DSS, FISMA, GLBA – and more – NDNB is ready to help.