SOC Reports Overview

PRIMARY CONTACT: Eric M. Wright CPA, CITP

System and Organization Controls (SOC) reports (formerly SSAE 16, SAS 70 report) are examinations provided by CPAs in connection with system-level controls of a service organization or entity-level controls at other organizations.

Business owners need to ensure sensitive data is protected, especially as it relates to financial and personally identifiable information (PII) and protected health information (PHI) of customers. Organizations also continue to face pressure from regulators and customers to demonstrate that adequate controls are in place with respect to the processing of transactions and internal controls over financial reporting. Government regulations, including Section 404 of the Sarbanes-Oxley Act of 2002 (SOX 404), Gramm-Leach-Bliley Act (GLBA) and Health Insurance Portability and Accountability Act (HIPAA) stress the need for effective internal controls. System and Organization Controls (SOC) examinations provide management with assurance regarding the effectiveness of an organization’s internal controls, while also providing insights for opportunities to improve internal controls and risk mitigation activities.  Further, standard contracts typically require organizations to attest to the effectiveness of their internal controls. Obtaining a SOC report has become increasingly relevant for organizations of all sizes, as the resulting report can be provided to customers and prospective customers to demonstrate that effective internal controls and related safeguards have been implemented. 

Ensuring the company has robust internal controls and policies and practices in place is essential. In fact, many may expect to see a SOC report before doing business with a company. This examination (often referred to as a “SOC audit”) verifies that the controls, processes and procedures have been tested and indicates whether controls are effective. Some organizations may desire a SOC 1 examination, while others will obtain more value