Validating Internal Control Effectiveness

As an organization providing outsourced services to other businesses, you will likely be required to prove that the internal controls you have in place are valid. Driven by compliance or regulations, a single report is used to satisfy multiple requests your business may receive from your customers and prospects. The AICPA has created a framework consisting of multiple reporting options to allow you to validate the applicable business and operational controls supporting the services your provide. Service organizations look to PBMares to help create reports on internal controls, including:

• SOC 1 Reports

  These reports evaluate the effectiveness of controls used at a service organization on the entities’ financial statement. Organizations across the board, including publicly traded companies, private companies and not-for-profits may require verification that the third-party data security experts who work on their financial statements operate under a strong set of internal controls. These verifications come in the form of various levels of System and Organization Controls (SOC) reports. The reports assure your clients and prospective clients that your internal controls are secure. Examples of service companies that may require such reports include data center companies, loan servicing companies, medical claims processors and payroll processors.

  SOC 1 reports, also known as the Statement on Standards for Attestation Engagements (SSAE) 18, focus on your organization’s business processes and IT controls. Any that are likely to be relevant to an audit of your customers’ financial statements are documented in the report.

  There are two types of SOC reports: Type 1 reports test the design of your organization’s controls as of a certain date. Type 2 reports test whether your controls are properly designed, in place and documented as well as an opinion on operating effectiveness over a set time period (usually 12 months).

• SOC 2 Reports

  These reports are used to meet the needs of users that need detailed information and assurance about the controls at a service organization related to security, availability and processing integrity of the systems used. These reports concentrate on five Trust Services Principles: security, availability, processing integrity, confidentiality and privacy. SOC 2’s requirements allow data providers to decide how they want to meet the criteria. This flexibility means SOC 2 reports are unique to each company, and makes the choice of auditor particularly important. You need to choose an audit team with a deep understanding of SOC controls and best practices.

• SOC 3 Reports

  A general use report for those who need assurance about controls of a service organization, but do not have the ability to make use of a SOC 2.

• SOC: Cybersecurity

  Organizations need to show they are managing the threat of security breaches by having processes and procedures in place to detect, respond to, mitigate and recover from any breaches. Using the AICPA’s cybersecurity risk management reporting framework, PBMares’ team will give you the credibility you need to communicate the effectiveness of your organizations’ cybersecurity risk management program.

• SOC Readiness Assessments

  These assessments provide an overview of your organization’s preparedness for a successful SOC 1, 2, 3 or Cybersecurity audit. At the end of the assessment, our experts will let you know what control gaps or observations identified need to be addressed and remediated in order for your SOC audit to be successful.

Take Advantage of Our Experience

Our experienced cyber risk professionals have been performing IT audits and risk assessments for 15 years, and unlike standard IT providers, as CPAs and consultants, we have an intimate understanding of your organization’s unique processes and operations. You can rely on us for complete cybersecurity services and solutions tailored to your risk profile and network. .