Well, you are not alone. What is a SOC report and why did the AICPA change anything in the first place? To start off with, a Service Organization Controls (SOC) report is a report brand, not a standard. Previously, SAS 70 reports were being used for everything from their intended purpose (report on a service organization’s internal controls relevant to a user entities’ financial reporting) to piecemeal reports on non-homogeneous topics that would be used as a marketing tool (never the intent of SAS 70). A user entity is defined as any organization that is utilizing services provided by a service organization. You probably have seen companies claim that they are “SAS 70 certified” on their websites. However, there has never been a SAS 70 certification and SAS 70 reports were never “general use” reports to be used as marketing tools; instead, SAS 70 reports were restricted to specific audiences. With the new SOC reports, we now have options depending on who our intended reporting audience is, what the subject matter will be, and what the intended use of the report will be.
Here is a brief overview of the new SOC reports:
| Report Name |
SOC 1 |
SOC 2 |
SOC 3 |
| Underlying Standard |
SSAE 16 (formerly SAS 70) |
AT 101 |
AT 101 |
| Report Restrictions |
Restricted Use |
General Restrictions |
General Use |
| Intent of Report |
Reports on internal controls relevant to a user entities’ financial reporting |
Reports on operational, regulatory, or compliance related controls |
Reports on operational, regulatory, or compliance related controls |
For the first two SOC reports, there are two report types each: Type 1 and Type 2. The primary difference is if you want a report that not only opines on the suitability of control design, but also on operating effectiveness, you want a Type 2 report. The second major difference between a Type 1 and a Type 2 report is that a Type 1 report renders an opinion as of a specific date, while a Type 2 report additionally renders an opinion on the operating effectiveness of controls during a period of time.
Let’s look at a few examples. You work for a datacenter that provides cloud data backup services for its clients. One of your clients is undergoing an audit of their financial statements and the client’s auditor asks how they can be assured that the client’s data is secured. In turn, the client then calls you and asks for some type of assurance that you are protecting their data in a secure and compliant manner. You know that your company has strong controls in place to protect data; after all, data is your business! In this situation, the service being provided is not about controls over financial reporting, but about the privacy of the client’s data being housed on your company’s servers. Let’s assume the client does not want to use the report as a marketing tool. Since the client is requesting assurance solely to provide it to their financial statement auditor and will not be using the ensuing report for marketing, the best report type is a SOC 2 report. Most likely you will want to obtain a SOC 2 – Type 2 report to obtain reasonable assurance over the design and operating effectiveness of your company’s controls.
For another example, let’s choose a company providing payroll services. The service being provided is highly relevant to a client’s financial statements and the client will want assurance that there are strong controls in place over the financial services being provided. In this situation, a SOC 1 report would be the best fit. Once again, a SOC 1 – Type 2 report will provide additional value by providing an opinion regarding the design and operating effectiveness of internal controls over the payroll services.
It is important to note that, while SOC 1 and SOC 2 reports are restricted use, companies can register with the AICPA to use the SOC logo. This logo can be used to show your clients and partners that your company undergoes the SOC reporting process.
As a final example, let’s look at a situation where a small company wishes to obtain a report that can be used as a marketing tool. The only report that allows for unrestricted use and distribution is the SOC 3 report. This reporting program is managed through a partnership between the AICPA and the CICA (Canadian Institute of Chartered Accountants). The report is based off of the AICPA Trust Services Principles and Criteria. A special seal may be granted to an organization by CPAs that are licensed by the CICA. For more information on the SOC 3 seal and its permitted use, please click here.
All SOC reports must be performed by properly licensed CPAs. For more information from the AICPA on SOC reports and how to leverage them properly for your business, please click here.
As always, if you have more questions after reading this article, please feel free to contact me and I would be happy to work with you on clarifying these new options!
