Question: What Does SOC 2 Stand For?

Answer: SOC 2 stands for “System and Organization Controls”, for which there are two (2) main types of SOC reports – SOC 1 reports and SOC 2 reports. While SOC 1 reports are primarily aimed at service organizations who provides essential services that could impact financial reporting for their clients, SOC 2 reports are geared towards the large and growing technology industry that is now taking shape.

As stated by the American Institute of Certified Public Accountants (AICPA), “System and Organization Controls (SOC) is a suite of service offerings CPAs may provide in connection with system-level controls of a service organization or entity-level controls of other organizations.”

The Importance of SOC 2 Reports

As for SOC 2 reports, they are intended to meet the needs of a broad range of users requiring comprehensive information and assurance about the controls at a service organization relevant to security, availability, and processing integrity of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems.

As such, SOC 2 reports play a vital role in helping service organizations illustrate their internal controls to other entities requiring such information. Think of it this way in much more simpler terms. You have a business, and you’re relying on other businesses to perform critical functions that are essential to your success. So, don’t you want to know – don’t you deserve to know – that whatever services you’re outsourcing to these businesses, that they have the proper internal controls in place? Yes, you do, and it’s why SOC 2 audits have been experiencing massive growth in recent years, and will continue to do so.

A Prime Example of the Importance of SOC 2 Audits

Here’s a perfect example of how a business relying on another business (i.e., service organization) and how SOC 2 audits come into play. Let’s say you outsource the management of your network to a Managed Security Services Provider (MSSP). This MSSP is now essentially responsible for configuring and maintaining your firewalls, routers, load balancers, and other essential network devices. Don’t you want to learn more about the policies, procedures, and processes relating to the MSSP’s core services? If so, then requesting a SOC 2 report from the MSSP is the logical next step.

Five Important Things to Know about SOC 2 Audits.

1. They’re growing in Demand: We live in a digitally driven world, and also a world where outsourcing other businesses has fast become the new norm. With that said, SOC 2 audits have become the go-to assessment methodology for thousands of servicer organizations throughout the globe.

2. They’re often Performed on Technology Companies: Companies that are prime candidates for SOC 2 compliance audits are those in the technology space – data centers, Managed Security Services Providers (MSSP), Software as a Service (SaaS) entities, software development businesses, and so much more.

Are you using Amazon AWS for hosting? Learn about SOC 2 reporting for businesses using AWS

3. They often require an upfront Scoping & Readiness Assessment: Diving head first into a SOC 2 audit with little or no guidance and preparation is not recommended, and it’s why a SOC 2 Scoping & Readiness Assessment is a smart move if you’re new to the world of SOC auditing. Benefits of an engagement include the following: proper scoping in terms of people, business processes, and relevant third-parties involved in the audit; identifying and putting in place a plan-of-action for gaps and any other types of deficiencies found in one’s control environment; developing a realistic roadmap for compliance, complete with deliverables to be provided to the auditors.

4. They’re an annual commitment: Once you’ve entered the world of regulatory compliance, it generally becomes an annual commitment. Why? Because your clients – and prospects – will want to know all they can about your internal controls. More specifically, businesses looking to do business with YOUR company want assurances of how you operate on a daily basis. They want to know about your security and operational policies, procedures, and processes.

They obviously can’t pull up a chair and be on site every day, but they can request that you perform an annual SOC 2 report. In today’s world of growing outsourcing services, more and more businesses are relying on the functions of other entities, hence, the rise in SOC reporting.

5. Only a CPA or CPA firm can issue a SOC 2 report: While consulting firms and consultants often perform SOC 2 scoping & readiness assessments, only a Certified Public Accountant (CPA) or CPA firm can actual issue a SOC 2 report. NDNB has been one of North America’s leading providers of regulatory compliance audits for the last 15 years. Contact Christopher Nickell, CPA, at This email address is being protected from spambots. You need JavaScript enabled to view it., or call him at 1-800-277-5415, ext. 706 to learn more about our SOC 2 services, and other compliance solutions for your business.