SOC Reports – What you need to know before you begin

One of the most frequent calls we receive is from service organizations that have come to the realization that they need a SOC report to satisfy an important client. Understanding what to expect as you engage in your first SOC audit can go a long way to ensuring you end up with a clean report and minimal disruption to your operations.

Increasingly, service organizations are specifically required to complete a SOC audit in contract language as a condition of doing business with many companies. If you think about it, it makes sense: the client is entrusting you with vital and critical business processes and they want independent assurance your organization has adequate governance and effective controls in place. Failure to have a SOC report available can create a lot of unwanted scrutiny and even worse — the loss of an important customer.

Let's address the most common question first — how long is this going to take? If you engaged a SOC auditor today, you are looking at months, not weeks, as the earliest you will have a report ready to provide to your customers. The process takes time and will almost always require a period of preparation before the audit can even begin. How long the preparation takes will be dependent on how motivated and committed your management team is to being ready. Once you have made the decision to proceed, there are some important steps you can take to ensure the audit process will be smooth and that there will be no unwelcome surprises.

Get Your Leadership Team Aligned

The first and most vital step is to make sure your entire management team and key stakeholders are well-informed and engaged in the process. Once they know what is expected they can take steps to be prepared when the auditor comes to inspect the processes and controls that they are responsible for. One common mistake is to delegate the entire SOC audit to a single individual that often does not have the required access, information, or authority to ensure the auditor's requests are addressed completely and timely. It is, however, ideal to designate a single individual to be a point person to work closely with the SOC auditors to ensure all requests and questions are addressed.

Define Your Scope

The next step is to determine the scope and boundaries of your system (which is the services you provide to your customers and is the subject matter the SOC auditor will be examining). Scoping will involve determining which services and processes are to be included — and those that will not — in your audit. In some cases, a service organization may have specific services or offerings that are not relevant to their customers requesting the SOC report, and therefore should not be included in the scope. Determining the boundaries of your system will involve defining what systems, people, processes, and vendors you outsource processes to (subservice providers).

Prepare Your System Description

Your system description is a narrative document you will prepare that will be a key component of your final SOC report. The purpose of the system description is to provide your user entities and user auditors a complete understanding of your company as a whole, the services you provide, and the controls you have in place to ensure timely, complete, and accurate delivery of those services. Your SOC auditor will address your system description in the final opinion regarding whether it is fairly presented and does not omit or distort information that is important to the reader.

Know Your Controls

The last major component of preparing for the SOC audit is determining your controls. If you are doing a SOC 1, you will define your own control objectives and then specific control activities that demonstrate the control objectives are met. A SOC 1 is focused on Internal Control Over Financial Reporting (ICFR).

A SOC 2 audit is different from a SOC 1 in that a SOC 2 is criteria driven and the control objectives are specified by the AICPA. A SOC 2 report will contain one or more of five Trust Services Categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Work With the Right Partner

Blair Carlisle has guided hundreds of service organizations through SOC 1 and SOC 2 audits, from initial scoping through final report. We work in partnership with your audit firm — on the Fieldguide platform — to make the process as efficient and low-friction as possible for your team.

If you're considering your first SOC audit or looking to streamline your annual process, contact us to start a conversation with a senior advisor.