Course info

According to the American Institute of Certified Public Accountants (AICPA), SOC Report help service organizations "that operate information systems and provide information system services to other entities establish trust and confidence in their delivery of services' processes and controls through a report by an independent Certified Public Accountant". Because your clients will frequently be required to adhere to the audit requests from external accounting firms, the results of your SOC audit will assist make such audit procedures run more smoothly.

Today's businesses have seen a dramatic increase in the use of outsourced providers to assist with executing processes from payroll, accounts payable, information technology, benefit plan administration and many other core processes. These processes ultimately have an impact on an organization's internal control over financial reporting but also could impact compliance and operational issues.

In 2011, the Statement on Standards for Attestation Engagements (SSAE) 16 replaced the former Statement on Auditing Standards (SAS) 70. In May 2017, a new standard, SSAE 18, superseded SSAE 16. 

The concepts covered in this course are referred to as a Service Organization Control Report (SOC). Organizations who utilize outsourced providers should understand the various types of SOC reports (SOC 1 vs SOC 2 vs SOC 3), their intended use and their implication on a company's financial reporting process, regardless of your status as a publicly traded or privately held organization.  The process can be complicated to understand as a user organization. Currently, several types of SOC Reports exist including:

• SOC 1 - Type 1
• SOC 1 - Type 2
• SOC 2 - Type 1
• SOC 2 - Type 2
• SOC 3
• Cybersecurity SOC

This course speaks briefly to the transition from SAS 70 to SSAE 16 and now SSAE 18.  However, the focus is on the various Service Organization Control Reports, their purposes and uses.