Why You Need SOC Audits

SOC audits assess whether IT systems are compliant with new federal laws and IT international standards.


  • The AICPA has created SOC standards to address the problem of data security.
  • Federal regulations require that businesses safeguard personal, and nonpublic data.
  • SOC 1 reports replace SAS 70.
  • SOC 2 and SOC 3 reports provide new standards to assure greater data security.

 Cyber espionage has become major problem for information technology in the United States and internationally.  Part of the reason is the system designs and operating effectiveness of the technological information systems used by financial institutions, service organizations and others that process private and nonpublic information do not provide adequate privacy and protection controls    These intrusions have become a serious financial problem for users of information technology systems.  Federal law requires that all financial institutions, service organizations and others handling private and nonpublic utilizing information technology provide evidence that they have incorporated adequate controls for the protection of the data. To provide proof of meeting the law, those processing the data must produce a management description of their system and controls that asserts the suitability and the effectiveness of the controls protecting the system. An independent CPA experienced and knowledgeable about IT systems or a CPA.CITP auditor must be engaged to attest to the suitability of the measurements and effectiveness of the controls described by the management report before the information system  can be certified to be in compliance with the Service Organization Controls (SOC) standards.  The AICPA have issued regulations and guidelines for those performing the audits and preparing reports to determine if the system is certifiable.

The Statement of Standards for Attestation Engagements, No. 16 (SSAE 16) issued April 2010 by AICPA’s Auditing Standards Board became effective on June 15, 2011.  SSAE 16, establishes a universal standard and recommended guidelines for the audit of financial institutions, service organizations and others processing confidential, private and nonpublic data. The standards and guidelines were issued in response to the dictates of the Safeguards Rule contained in the Gramm-Leach-Bliley Act that became law on November 12, 1999. They establish a universal standard for for all SOC audits. SSAE 16 is considered to contain the same requirements as contained in the International Standard on Assurance Engagements (ISAE) 3402. SSAE 16 includes new guidance for assurance audits of Internal Controls over Financial Reporting (ICFR) for Service Organizations that is also effective June 15, 2011 .

The Safeguards Rule requires all financial institutions to design, implement and maintain safeguards to protect customer information. The Safeguards Rule applies not only to financial institutions, that collect information from their own customers, but also to financial institutions such as credit reporting agencies, appraisers, and mortgage brokers that receive customer information from other financial institutions. (For details see Disclosure of Nonpublic Personal Information, codified at 15 U.S.C. §§ 6801.)

The new  uniform auditing standards are set forth in AICPA’s guide; Reports on Controls at a Service Organization Over Security, Availability, Processing Integrity, Confidentiality or Privacy, issued in 2011 and became effective June 15, 2011.  The guidelines document is known as Service Organization Controls , (SOC).  The guidelines describe three types of audits labeled  as SOC 1, SOC 2 and SOC 3.

A SOC 1 audit examines and tests information technology (IT) infrastructures according to the terms associated with ICFR that replaces SAS 70 which are part of the Statement of Standards for Attestation Engagements, SSAE 16- Reporting on Controls at a Service Organization adopted April 2011.

SOC 2 and SOC 3 audit processes are conducted in accordance with AT Section 101 and relies on the recently released AICPA audit guide titled ‘’ Reports on Controls at a Service Organization over Security, Availability, Processing Integrity, Confidentiality or Privacy’’.

These audits include tests of the information systems and controls along with other procedures necessary to enable the auditor to express an unqualified opinion that the information technology systems and controls described by the management assertion allow, in all material respects, conformity with the established standards.

To provide a professional solution for these new standards the team at Integrated Accounting Services (IAS) performs audits for service organizations and their clients during the same testing period where possible.  IAS’s integrated approach to auditing both the service organization and its clients provides increased security, integrity and privacy for all systems. Timely coordinated reports and periodic follow-ups are part of the integrated approach to qualifying service organizations and their user entities and reporting the higher level of assurance to responsible parties.

This article is provided by Integrated Accounting Services for those seeking clarification of IT system and control requirements. Please contact us if you need an assessment of your system and to determine whether you need a SOC 1 or a SOC  2 audit to assure clients of your compliance with new standards.


Related articles:

  1. What Businesses Can Profit From SOC 2 Type 2 Audits?
  2. SOC Audit Standards for Service Organizations

Leave a Reply

Your email address will not be published. Required fields are marked *

Go back to top