CPAs & Advisors
SOC (formerly SAS 70) Audits
Service Organization Control (SOC) Reports Have Replaced SAS 70 Reports
Effective June 15, 2011, “SOC” Reports replaced SAS 70 reports. SOC reporting engagements result in three types of reports which address the policies, procedures and controls of an organization that processes transactions for others. The report provides reasonable assurance about the accuracy of the description of the organization’s control procedures, their appropriateness and, in certain cases, their operating effectiveness. To issue a report, an auditor reviews management’s control objectives and procedures.
Both SOC 1 and SOC 2 services maybe performed as either a Type 1 (controls are properly designed, in place and documented at a point in time) or Type 2 (controls are properly designed, in place, documented and are operating effectively over a period of time) report.
The change from SAS 70 to SOC Reports was primarily designed to align with international accounting standards. However, the new change also provides options for companies that do not process financial transactions, but require assurance reporting as part of their services for their customers.
Using SOC Engagements For Other Compliance Matters
