Introduction to SOC for Service Organizations Reporting

SOC reporting fundamentals

Understanding system and organization control reporting guidance and common practice issues will provide you with the foundational knowledge to effectively perform SOC for service organizations examinations.

You’ll learn the basics by exploring topics, including:

• Purposes of SOC 1®, SOC 2® and SOC 3® reports
• Differences between the reports and their intended users
• Relevant standards applicable to SOC 1, SOC 2 and SOC 3 reporting engagements
• Common peer review findings

Additionally, you’ll review how to provide attestation services related to the effectiveness of a service organization’s controls that affect

• internal control over financial reporting (SOC 1) and
• controls related to information privacy, security, confidentiality, availability, and processing integrity (SOC 2 and SOC 3).

Guidance for examinations

Knowing the guidance that pertains to SOC reporting engagements will set you up for successful engagements. You’ll delve into relevant guidance, such as:

• Trust Services Criteria
• SSAE No. 18
• Guidance in the SOC 1 and SOC 2 guides.

Focusing on audit quality

You’ll enhance audit quality by recognizing, preventing, and addressing common peer review findings in SOC examinations.

Who Will Benefit

Service auditors, service organization management, financial statement auditors, internal auditors, and entities that outsource functions to service organizations.

Key Topics

• Purposes of SOC 1®, SOC 2®, and SOC 3® reports
• Differences between the reports and their intended users
• Standards that are relevant and applicable to SOC 1, SOC 2, and SOC 3 reports
• Common peer review findings related to SOC engagements
• Trust Services Criteria
• SSAE No. 18
• Guidance in the SOC 1 and SOC 2 guides.

Learning Objectives

• Recall key definitions related to SOC for service organizations examinations.
• Distinguish between SOC 1®, SOC 2®, and SOC 3® reports.
• Identify the guidance that is relevant and applicable to SOC 1, SOC 2, and SOC 3 reporting engagements.
• Identify planning considerations and responsibilities.
• Recall how to execute procedures related to design and operating effectiveness of controls and to evaluate results.
• Identify the components of a system.
• Recognize the AICPA trust services criteria.
• Recognize requirements for reporting and completing the engagement.