Service organizations provide services to “user entities”, for which these services are likely to be relevant to these user entities’ internal control for financial reporting. They are generally required to conduct a SOC examination to obtain a recognized level of assurance on their internal controls. Typical organizations include:
Designed to help service organizations build trust and confidence through an independent CPA report.
Addresses internal control over financial reporting and demonstrates compliance with regulations like the Sarbanes-Oxley Act.
Focuses on IT service parameters (security, availability, privacy) to satisfy vendor management and regulatory requirements.
A short-form, less technical report with a "seal of approval" designed for marketing purposes and website display.
SOC 1: Statement on Standards for Attestation Engagements No. 16 (SSAE 16) guidance.
SOC 2 & SOC 3: AICPA - Canadian Institute of Chartered Accountants (CICA) Trust Services Principles and Criteria: security, availability, processing integrity, confidentiality, and privacy.
Note: SOC 1 and SOC 2 can be either Type I or II. SOC 3 is neither.