< Back to Thought Leadership

FAQ: System and Organization Controls (SOC) Reports

What kinds of companies need SOC reports?

Organizations that provide the following types of services for customers/clients may benefit from a SOC examination and report to demonstrate to customers/clients the strength of their internal controls:

  • Software as a Service
  • Outsourced Transaction Processors (e.g., Payroll Processors, TPA’s)
  • Professional Services with Access to Sensitive Client Data (e.g, Accounting Firms, Law Firms, Comp & Benefit Consultants, etc.)
  • Outsourced Data Centers/Co-Location Facilities
  • Resellers of Credit Reporting Agencies (Equifax, TranUnion, Experian, etc.)
  • Outsourced Security Operations Centers
  • Business Associates of Covered Entities (Healthcare)

What are SOC Reports?

SOC reports help demonstrate:

  • the control activities that your organization has implemented over the processing of financial transactions or data, or
  • the actions that your organization has taken to address the security, availability, processing integrity, confidentiality, and/or privacy concerns clients have related to their data and information.

They can come in three different forms: SOC 1, 2, or 3.

What is a SOC 1 Report?

The purpose of a SOC 1 report is to communicate a service organization’s controls relevant to a customer’s internal controls over financial reporting. SOC 1 reports may help demonstrate compliance with various regulations, such as Sarbanes-Oxley or Model Audit Rule.

What is a SOC 2 Report?

The purpose of a SOC 2 report is to help customers understand controls in place related to security, availability, processing integrity, confidentiality, and/or privacy. SOC 2 reports may help demonstrate compliance with regulations such as PCI, HIPAA, GLB, FIDICA, etc. Distribution of these reports is restricted.

What is a SOC 3 Report?

The purpose of a SOC 3 report is to inform any interested parties about the operating effectiveness of internal controls at the service organization relevant to security, availability, processing integrity, confidentiality, and/or privacy, in connection with a SOC 2 engagement. The SOC 3 is a general use report that contains less detail than a SOC 2, but its distribution is not restricted.

What are the attestation standards related to SOC reports?

All SOC reports are completed within the AICPA’s Auditing Standards Board (ASB) Statements on Standards for Attestation Engagements (SSAE), SSAE 18 Attestation Standards: Clarification and Recodification.

I’ve seen SSAE 16 and AT 101 listed on other sites. What are those?

SSAE 16 is the old standard for SOC 1 engagements and AT 101 is the old standard for SOC 2 and SOC 3 engagements. SSEA 18 was released in April of 2016.

What is the difference between Type 1 and Type 2 reports?

Type 1 attests to management’s system and suitability of the design of controls as of a specified date, ie: whether the controls were designed properly and implemented as of a point in time.

Type 2 attests to management’s system and suitability of the design of controls over a specified period of time, rather than one date, ie: whether the controls were designed properly, implemented and operating effectively over a period of time.

What kind of SOC report do I need?

We created a quick quiz to determine which SOC report might best serve your organization’s needs.

Have more questions or want to talk?

If you have more questions or would like to begin a discussion regarding a SOC Report for your organization, please contact Tom Skoog at tskoog@blueandco.com or Jennifer Miloszewski at jmiloszewski@blueandco.com.

Proposed Accounting Standards Update (ASU) “Presentation and Disclosure by Not-for-Profit Entities for Contributed Nonfinancial Assets”

Proposed Accounting Standards Update (ASU) “Presentation and Disclosure by Not-for-Profit Entities for Contributed Nonfinancial Assets”

On February 10, 2020, the Financial Accounting Standards Board (FASB) issued a Proposed Accounting Standards Update (ASU) “Presentation and Disclosure by Not-for-Profit Entities for Contributed Nonfinancial Assets” designed to improve transparency in how not-for-profit organizations present and disclose contributed nonfinancial assets. Also known as gifts-in-kind, contributed nonfinancial assets include fixed assets such as land, buildings, and […]

Learn More
Do your rental activities qualify you as a real estate professional for tax purposes?

Do your rental activities qualify you as a real estate professional for tax purposes?

By Alan Zgoda For Real Estate Professionals (REPs), two of the most important questions asked for tax purposes are, “Did I materially participate?” and “Is this a rental activity or not?” For better or worse, the answers to these questions can completely change how you are treated for tax purposes. In 2019, two court cases […]

Learn More
PARTNERSHIP CAPITAL ACCOUNTS_ 2018 CHANGES AND NOTICE 2019-66 (1)

Partnership Capital Accounts: 2018 Changes and Notice 2019-66

By Miranda Aavatsmark Who has not frantically awoken from a bad dream in the middle of the night and been relieved to realize that it was not real? I have a reoccurring dream (nightmare) that I either have to go back to college and retake classes or sit for the CPA exam again. I used […]

Learn More