Security & Compliance Blog

Service Organization Control (SOC) Reports, more commonly known as SOC 1, SOC 2, and SOC 3, as you may or may not be well aware of by now, represent the new framework put forth by the American Institute of Certified Public Accountants (AICPA) for reporting on controls at service organizations. 

SOC 1, is essentially tied to service organizations for which reporting is ICFR based, that is, internal controls related to financial reporting. SOC 2 and SOC 3, however, represent a sincere  and genuine attempt by the AICPA to meet the growing demands and complexities of reporting on controls for service organizations OUTSIDE that of ICFR. In essence, it's a move to correct the misguided efforts by many who used the SAS 70 standard in an incorrect manner. Will it work? Well, the early signs are not that encouraging as I've seen recent press releases for data centers and managed services entities becoming SSAE 16 "certified" or "compliant".

And by the way, the terms "certified" and "compliant" are grossly incorrect, for which you can learn more about how this has really irked the AICPA. Did they simply forget about SOC 2 and SOC 3? Are their clients simply sold on the merits of out with one standard (SAS 70), in with the new (SSAE 16), without being educated on the SOC framework? Have we as CPA's along with the AICPA not done enough to educate service organizations?

Well, I think it's a little of everything.  I'm still hopeful that this "problem" will correct itself. I can already see the technical arguments, or rather, excuses, for issuing a SSAE 16 Type 1 or Type 2 report for a data center, managed services entity, or some other cloud type infrastructure....and here they are: "Well, that's what our clients wanted, so we used the SSAE 16 standard". Or how about this one, for which I"m hearing alot of: "Hey, if the controls are "likely relevant" to ICFR, then we can issue an SSAE 16 Type 1 or Type 2".  Or, the one that takes the cake is this one: Nobody is taking SOC 2 and AT Section 101 seriously yet, so for now, I'll just fall in line and do what most other firms are doing and going right from SAS 70 to SSAE 16".

SOC 3 Reports also addressReporting on Controls relevant to Security, Availability, Processing integrity, Confidentiality, and Privacy in accordance with general predefined criteria within theTrust Service Principles.  Please note that these reports are to be prepared using the AICPA and the Canadian Institute of Chartered Accountants (CICA) Trust Services Principles, Criteria, and Illustrations for Security, Availability, Processing Integrity, Confidentiality, and Privacy.

The framework for the Trust Services Principles has been around for quite some time, yet curiously, never really caught on as many would of imagined.  Lastly it is considered a general use report and comes with a public seal.  And much like SOC 2 reports, SOC 3 reports also use AT Section 101 as the professional standard for service auditor guidance.   It will be interesting in the coming years how notable SOC 3 reports become in comparison to SOC 1 and SOC 2 reports.

To learn more about SOC 3 reporting standards and all other regulatory compliance services provided, please contact Chris Nickell, CPA, at 1-800-277-5415, ext. 706.

SOC 2 reports, which will come to be known as Reporting on Controls Relevant to Security, Availability, Processing integrity, Confidentiality, and Privacy, are to be conducted in accordance with AT Section 101. Thus, SOC 2 will effectively insert itself as the primary reporting option to be used for service organizations reporting on controls outside the scope of financial reporting.  In simpler terms, Software as a Service (SaaS) companies, software development entities, cloud computing organizations, data centers, managed services, and many more, will be using the SOC 2 framework for reporting on controls.  And much like SOC 1 reporting, a service organization can either be issued two (2) type of SOC 2 reports, a Type 1 and a Type 2.

If you stop and think about it, this is quite significant for a number of reasons.  First and foremost, the SOC 2 framework is specifically geared towards the exponential growth of technology and security related service organizations, of which many provide outsourcing services to user entities.  Second, it hopefully will correct a huge misunderstanding within the business community at large; the myth that SAS 70 was an all-in-one reporting standard for any type of service organization.  As you now know, this is simply untrue and we now have an acceptable and viable reporting option for controls outside the scope of financial reporting.

Lastly, SOC 2 reports are designed to address generally the following key system attributes and traits:

• Availability: That the system is available for operation and use as committed or agreed.
• Security: That the system is protected against unauthorized access, both physically and logically.
• Processing Integrity: That System processing is complete, accurate, timely, and authorized.
• Confidentiality: That the information held by an organization is securely protected.
• Privacy: That personal information is protected.

As a service organization, you will need to evaluate your current compliance requirements and commitments to your customers and start to ask yourself what reporting option do "we" fall under, SOC 1, SOC, or even SOC 3?  If you have been receiving SAS 70 audit reports from your CPA firm in the past, what do your customers expect in the future?  More importantly, what is the correct SOC reporting framework that "we" should adhere to?  NDB Accountants and Consultants can help answer these pressing questions regarding the new compliance requirements with the SOC framework. 

When you add it all up, phrases like SOC 1, SOC 2, SOC 3, SSAE 16, and AT Section 101 can become quite confusing. Get the facts and speak to an expert. Call Chris Nickell, CPA, directly at 1-800-277-5415, ext. 706 to get the answers you need.  Furthermore, you can email Chris at This email address is being protected from spambots. You need JavaScript enabled to view it..