AICPA's SOC Compliance
System and Organization Controls (SOC)
SOC(System and Organization Controls) is a type of audit report that attests to the trustworthiness of services provided by a service organization. It is commonly used to assess the risks associated with outsourced software solutions that store customer data online.
SOC reports are designed to help service organizations, entities that process information or handle business transactions on behalf of its customers, build trust and confidence in their service delivery and controls over information and data through a report prepared by a CPA.
Type of SOC Reports
Type 1 -Throughout Specific Period
Type 2-As on Specific Date
Reporting on Controls at a Service Organisation Relevant to User Entities’ Internal Control over
Financial Reporting: This meets the needs of user entities’ managements and auditors as they
evaluate the effect of a service organization’s control on a user entity’s financial statement
assertions. These reports are important components of user entities’ evaluation of their
internal controls over financial reporting for purposes of compliance with laws and regulations
and for when user entity auditors plan and perform financial statement audits.
Type 1 -Throughout Specific Period
Type 2-As on Specific Date
Reporting on Controls at a Service Organisation
Relevant to Security, Availability, Processing Integrity,
Confidentiality, or Privacy: For those who need to
understand internal control at a service organisation as
it relates to security, availability, processing integrity,
confidentiality or privacy. These reports can play an
important role in oversight of the organisation, vendor
management programs, internal corporate
governance and risk management processes, and
regulatory oversight. Stakeholders who may use these
reports include management or those charged with
governance of the user entities and of the service
organization, customers, regulators, business partners
and suppliers, among others.
Type 1 -Throughout Specific Period
Type 2-As on Specific Date
Trust Service Principles, Criteria, and Illustrations:
Designed to accommodate users who want assurance
on a service organization’s controls related to security,
availability, processing integrity, confidentiality or
privacy but do not have the need for the detailed and
comprehensive SOC 2 Report.
5 Trust- Backbone of SOC
Security-
The protection principle refers to safety of system sources towards unauthorized access. Access controls help prevent potential system abuse, theft or unauthorized elimination of data, misuse of software, and improper alteration or disclosure of information.
IT protection equipment such as network and internet application firewalls (WAFs), two thing authentication and intrusion detection are useful in preventing protection breaches that can lead to unauthorized get entry to of structures and data.
Availability-
The protection principle refers to safety of system sources towards unauthorized access. Access controls help prevent potential system abuse, theft or unauthorized elimination of data, misuse of software, and improper alteration or disclosure of information.
IT protection equipment such as network and internet application firewalls (WAFs), two thing authentication and intrusion detection are useful in preventing protection breaches that can lead to unauthorized get entry to of structures and data.
Processing Integrity-
The processing integrity precept addresses whether or not a system achieves its cause (i.e., delivers the proper data at the right fee at the right time). Accordingly, data processing need to be complete, valid, accurate, timely and authorized.
However, processing integrity does not always imply information integrity. If information contains errors prior to being input into the system, detecting them is now not typically the accountability of the processing entity. Monitoring of data processing, coupled with first-class assurance procedures, can assist make sure processing integrity.
Confidentiality
Data is considered exclusive if its access and disclosure is confined to a specific set of persons or organizations. Examples may also encompass information meant solely for corporation personnel, as nicely as enterprise plans, mental property, inner charge lists and different types of touchy monetary information.
Encryption is an necessary control for defending confidentiality all through transmission. Network and application firewalls, collectively with rigorous access controls, can be used to protect facts being processed or saved on computer systems.
Privacy
The privacy principle addresses the system’s collection, use, retention, disclosure and disposal of non-public records in conformity with an organization’s privacy notice, as properly as with standards set forth in the AICPA’s generally accepted privacy principles (GAPP).
Personal identifiable information (PII) (like, Gender, name, address, Social Security number). Some private information related to health, race, sexuality and religion is additionally regarded sensitive and commonly requires an more level of protection. Controls ought to be put in place to protect all PII from unauthorized access.