Following the recent release of final guidance from the American Institute of Certified Public Accountants (AICPA) on the new Service Organization Control (SOC) reporting options—and the retiring of the SAS 70 standard as of June 15, 2011—we thought this would be an appropriate time to answer the question many financial, technical and marketing executives have been asking: What does a SOC report look like?
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Anatomy of Service Organization Control (SOC) Reports - July 2011
1. Anatomy of a SOC Report Thursday, June 23, 2011 (1:00 pm – 2:00 pm)
2. Seminar Logistics All attendees are muted during the presentation – We cannot hear you Audio difficulties Hang up and redial (805) 309-0022 Enter access code 653-581-897 Enter the Audio Pin displayed on your Attendee Control Panel We will take questions at end of presentation During the presentation you may type questions into the Question Screen on your Attendee Control Panel – click Send Privately CPE credit Copy of today’s presentation Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
16. Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Agenda Attestation versus Auditing Standard SOC 1 versus SOC 2 or 3 – which report do I need? SOC 1 Report versus a SAS 70 Report SOC 2 Report SOC 3 Report Anatomy of a SOC Report Questions
17. Copyright 2009. Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Attestation versus Auditing Standard
18. Attestation versus Auditing Standard SAS 70 – Audit Standard In the past, the SAS 70 report was intended to assist service organizations’ customers and their auditors in the context of a financial statement audit. SSAE 16 – Attestation Standard (effective June 15, 2011) Traditional SAS 70 reports are being replaced by Service Organization Control Reports (or “SOC” reports) Now, three SOC reports have been defined to replace SAS 70 and help service organizations meet a broader set of specific user needs – including addressing security, privacy and availability. Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
19. Reason for the change Need for greater international consistency (ISAE 3402) New Technologies (SaaS, cloud computing, privacy concerns for emerging technologies) Clarity of purpose (misunderstandings, misapplications, misuses of the former SAS 70 report) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
20. Copyright 2009. Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Which Report do I need?
21. SOC 1 versus SOC 2 or 3 – which report do I need? Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SOC 1 Former SAS 70 Reports – New SSAE 16 guidance Focuses on internal controls over the user organizations’ financial reporting Includes details about the systems and processes of the service organization Auditor to Auditor Report Restricted Use Report SOC 2 Primary interest around compliance and operational controls Includes details about the systems and processes of the service organization Trust Criteria: 1) Security, 2) Availability, 3) Processing Integrity, 4) Confidentiality, and 5) Privacy Restricted Use Report SOC 3 Primary interest around compliance and operational controls Similar to SOC 2 Report, but does not provide specific service organization company details Same work completed as the SOC 2 report General Use Report Seal can be placed on the service organization’s web site
22. SOC 1 versus SOC 2 or 3 – which report do I need? Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
23. Management assertion now within the report Opinion on the design of the controls Type I Report – design and the presentation of controls are still a point in time (“as of date”) Type II Report – opinion on the design of the controls and their operating effectiveness over the reporting period (“period of time”) Service organization still documents their control environment Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SOC 1 Report versus a SAS 70 Report
24. Trust Criteria versus User Organization Defined Objectives Five Principals Security Availability Processing Integrity Confidentiality Privacy Service Organization selects which principal they would like to report on Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SOC 2 Report
25. SOC 3 Report Most similar to SOC2, including the use of Trust Principles Reports itself omits specific detail regarding control testing Only General Use report – can be shared with prospects May have only limited value to user organization auditors Optional SOC3 seal available for the website Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
26. Copyright 2009. Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Anatomy of a SOC Report
27. Anatomy of a SOC Report Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
28. Anatomy of a SOC Report Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 1: Auditor’s Opinion The “opinion” by the service auditor Description of controls is fairly stated (no omissions or distortions) Controls were suitably designed to achieve the stated control objective Controls are effectively designed (Type I) Controls were operating effectively (Type II)
29. Anatomy of a SOC Report (Continued) SECTION 2: Management Assertion Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
30. Anatomy of a SOC Report (Continued) SECTION 2: Management Assertion (Continued) Management has determined the control objectives and control activities are reflected within the report Management believes the description of the controls are fairly presented Controls are suitably designed to achieve control objectives Management is not aware of any illegal acts, fraud, or uncorrected errors by management employees of the Company Management has disclosed all subsequent events, as applicable, that would have a significant effect on user organizations Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
31. Anatomy of a SOC Report (Continued) Section 3 – Overview of Operations Company Overview Services Provided Organizational Chart Executive Management Team Professional Biographies Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
32. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 4: Control Environment Control Environment Tone at the Top Discipline and Structure Risk Assessment Internal and External Risk Factors Identification of Risks Control Activities Policies and Procedures used to mitigate risk Information and Communications Processing of Company Transactions Reporting on Company Transactions Flow of communication throughout the Organization Monitoring Assessment of your activities to ensure compliance
33. Anatomy of a SOC Report (Continued) SECTION 4: Control Environment (Continued) Systems Overview Services provided – classes of transactions processed Description of procedures Transaction initiation Transaction authorization Processing Reporting Any changes that occurred within the audit period Subservice Organizations Brief description of what they do Carved-out of the report or included (inclusive method) Copyright 2010. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.
34. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 5: Control Objectives and Internal Control Structure Narrative description of the defined control objectives and control activities Includes within the process the defined control objectives and control activities
35. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 6: Information Provided by the Service Auditor Type I – Observation and Inquiry Type II – Test Procedures Performed and Testing Results
36. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 7: User Organization Control Considerations Examples of complementary administrative, physical, and technical controls Controls at user organizations that complement the controls at the service organization Example Client is responsible for complying with all accounting pronouncements and all laws or regulations related to internal controls Client is responsible for managing all system access and security authorizations
37. Anatomy of a SOC Report (Continued) Copyright 2011. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. SECTION 8: Additional Information Provided by Company Information not included within the descriptions of controls Examples: Business Continuity Disaster Recovery Plans Changes that may be taking place in the future The service auditor does not opine on information within this section
38. Copyright 2009. Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Anatomy of a SOC Report Questions?
39. Copyright 2009. Moody, Famiglietti & Andronico, LLP. All Rights Reserved. PRESENTERS Matthew V. PettineCGEIT, CISA, ASE, MCSEManaging Directormpettine@mfacornerstone.com(978) 557-5354 Robert A. BuschCPAPartnerrbusch@mfa-cpa.com(978) 557-5327 Michelle A. MackeyCFE, MBADirectormmackey@mfacornerstone.com(978) 569-2909 IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.
40. Copyright 2009. Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Anatomy of a SOC Report Thank you IRC Circular 230 Disclosure: To ensure compliance with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.
Notes de l'éditeur
I’d like to now introduce our speakers for this afternoon – our resident SAS 70 and SOC experts - Rob Busch,Michelle Mackey and Matt Pettine. Their respective backgrounds and areas of expertise ensure our clients get a well-rounded perspective and result in engagement deliverables that allow our clients to confidently demonstrate that their infrastructure, applications and processes are appropriately designed and operating effectively, which in turn paves the way for them to build trust with their customers.Our first speaker, Rob Bush, is an Audit Partner here at MFA. Rob has over fifteen years of experience in audit, reviews, and compilations. He works closely with clients on a variety of technical and business issues including revenue recognition, stock-based compensation, equity transactions, business combinations , SAS 70 and SOC audits and surprise examinations for registered investment advisors. He has extensive experience in Sarbanes-Oxley compliance consulting, SEC reporting, and performing financial statement audits for companies in the construction, high tech, service, manufacturing, and distribution industries.Our second speaker for this afternoon is Michelle Mackey. Michelle is a Director for MFA’s affiliate company, MFA Cornerstone Consulting, and plays an instrumental role in helping the firm's clients optimize performance, control risk and adhere to regulatory compliance. Michelle is sought after by clients for her expertise, particularly in the area of business process efficiency, SAS 70 and Sarbanes-Oxley compliance. In addition, as a Certified Fraud Examiner, Michelle works closely with clients to identify areas of fraud susceptibility within their current systems, procedures and transactions. Our third and final speaker this afternoon is Matt Pettine. Matt is the Managing Director of the IT Advisory Practice for MFA’s affiliate company, MFA Cornerstone Consulting. In his role Matt provides:-technical and managerial consulting -business risk assessment-customized application development -and infrastructure solutions. Matt assists clients in all aspects of MIS infrastructure and IT support, including -design, -planning, -system controls, -and hands-on implementation, testing and maintenance.So without further ado, I’d like to turn the floor over to Rob.
Thank you Michelle,Rob and Matt. We’d now like to address some of the questions sent to us during the presentation.Our first question is…
OK, that’s all the time we have for questions today. If we did not get to your question, we’ve made a note of it and will be sure to follow-up with you individually.Before we sign off, do any of the presenters have any final thoughts you want to leave the audience with?I’d like to thank all of you for joining us today. If you’d like to further discuss the new SOC reporting options and their applicability to your organization, please feel free to contact Rob, Michelle or Matt at the phone numbers or email addresses on the screen. And as a final reminder, we will be following up and sending all of you a link to access today’s presentation.Again, thank you for your time today.