SOC 1 SSAE 18 and/or SOC 2 compliance is becoming a must-have for hundreds of Atlanta businesses seeking to comply with growing client demands and industry specific regulations. Whatever your business offers, from I.T. services to operational and manufacturing of products, it seems as if the regulatory compliance mantra is sparing hardly any company today in the metro Atlanta region.
What’s interesting to note is that as Atlanta has increasingly become one of the true financial and IT markets in the country, the mandates for compliance have increased similarly also. Atlanta’s growing like never before – and that’s great – but so are the massive compliance mandates of SOC 1 SSAE 18 and SOC 2, along with PCI DSS, HIPAA, FISMA reporting, and much more. Need help? Then turn to the experts at NDNB, Atlanta’s premier provider of compliance services.
Essential Things Atlanta Businesses Need to Know for SOC 1 & SOC 2 Audits
Want to become SOC 1 SSAE 18 and/or SOC 2 compliant without having to spend thousands of needless dollars and dozens of additional operational hours? If so, then take note of the following compliance best practices for Atlanta, Georgia businesses:
1. It all starts with a Scoping & Readiness Assessment. Do you have a clear understanding of the road ahead for SOC 1 SSAE 18 compliance, particularly the milestones and associated deliverables? Have you taken the time to asses and remediate deficiencies within your internal control environment, such as policies and procedures and other technical constraints? Have you determined what the actual audit scoping boundaries are, the personnel to be involved in the SOC 1 SSAE 18 assessment process, and other critical issues?
If not, it’s time to perform a much-needed scoping & readiness assessment, an invaluable exercise for helping ensure the long-term success of your audit. Spending a few extra hours on the front-end of the audit will pay huge dividends in helping deliver an audit report on time and within budget. To learn more about NDNB’s scoping & readiness activities for Atlanta businesses, contact Christopher Nickell, CPA, at This email address is being protected from spambots. You need JavaScript enabled to view it., or call him directly at 1-800-277-5415, ext. 706.
2. What is ICFR? The ICFR concept – commonly known as Internal Controls over Financial Reporting – essentially focuses on internal controls related to financial reporting, something that the now defunct SAS 70 auditing standard was originally intended for. For service organizations that provide services to their clients that could impact financial reporting for such clients, then the ICFR component is to be assessed within the scope of a SOC 1 SSAE 18 report.
For example, if you as a service organization are performing material financial calculations for medical expenses that have to be paid out by your clients to their clients, then an auditor would want to assess the financial controls related to how, you, as a service organization, performs those calculations. In essence, any type of function performed by a service organization for their clients that is financial in nature and can impact another businesses’ financial reporting, ultimately brings in the ICFR component into auditing, which means having a SOC 1 SSAE 18 audit performed, not a SOC 2.
SOC 2 audits are generally geared towards technology companies such as data centers, cloud computing, managed service providers, and others.
3. Why the Growth in SOC 2 Audits? Simple, information technology is growing by leaps and bounds, and with that, a due-diligence auditing mechanism is needed for assessing and testing internal controls for many of today’s tech sector companies. Add to the fact that the Atlanta tech sector is witnessing huge growth in recent years, the SOC 2 auditing framework is now becoming a strict mandate for many technology firms in Georgia. As Atlanta’s economy continues to grow, so will the regulatory compliance mandates, especially SOC 2 audits.
In fact, the growth in SOC 2 audits is now outpacing that of SOC 1 audits, something that wasn’t the case back in 2011 when the new AICPA framework was launched. Sure, there are still technology companies performing SOC 1 audits – we don’t think it’s the correct assessment, in our professional opinion – so hopefully more entities will make the switch to SOC 2 audits once they clearly see the benefits.
4. Documentation is Incredibly Important. One of the biggest and most time-consuming aspects of SOC 2 compliance is documentation, more specifically, the need for having comprehensive and well-written information security policies and procedures. The amount of time and energy needed for documentation development of this magnitude can be staggering, and its why businesses turn to NDB as we offer industry leading security documentation for helping ensure rapid and swift SOC 2 compliance.
Businesses in Atlanta that begin the SOC 1 SSAE 18 and SOC 2 audit process often fail to recognize the importance of policies and procedures, and this ultimately causes huge challenges and constraints for organizations. The solution is to find a viable CPA firm that offers a full lifecycle of products, services, and solutions for Atlanta businesses – and that’s NDNB. To learn more, contact Christopher Nickell, CPA, at This email address is being protected from spambots. You need JavaScript enabled to view it., or call him directly at 1-800-277-5415, ext. 706.
5. Technical Remediation is Necessary. Sure, policies and procedures and other forms of documentation are vitally important for both SOC 1 SSAE 18 and SOC 2 compliance for Atlanta businesses, but so is the ability to remediate technical controls. Often times, service organizations will need to strengthen password parameters, employ additional server configuration and hardening procedures, implement vulnerability scanning services, and much more. After all, what good are policies and procedures if they don’t reflect the actual technical/security changes that need to take place?
A competent auditor can help assess your technical controls, while also providing meaningful feedback on items deemed necessary for remediation. The process “can” be a time-consuming one, it all depends on the maturity of your controls, the willingness to make the changes, and what resources you have for assisting in such endeavors.
6. Audits are an Annual Process. Yes, they are, so welcome to the world of regulatory compliance because it is here to stay. This means it’s important to find a well-qualified, highly competent CPA and advisory firm in Atlanta to become your trusted partner, and that’s NDNB. Contact Christopher Nickell, CPA, at This email address is being protected from spambots. You need JavaScript enabled to view it., or call him directly at 1-800-277-5415, ext. 706.
Atlanta’s Leading Provider of SOC 1 SSAE 18 and SOC 2 Audits
NDNB is Atlanta’s leading provider of SOC 1 SSAE 18 and SOC 2 audits. The Atlanta economy is absolutely booming, so if you’re looking for a proven, high-quality provider of regulatory compliance reports – SOC 1 SSAE 18, SOC 2, SOC 3, and more – then get to know us. Contact Christopher Nickell, CPA, at This email address is being protected from spambots. You need JavaScript enabled to view it., or call him directly at 1-800-277-5415, ext. 706.
