SOC Audit
Independent SOC 1, SOC 2, and SOC 3 examinations that give your customers and their auditors a CPA’s report on your controls.
Overview
When customers rely on your systems to process transactions, store data, or support their operations, they and their auditors often ask for a SOC report. A SOC examination is an attestation engagement performed by an independent CPA firm under AICPA attestation standards, including SSAE 18. The result is a formal report containing the CPA’s opinion on your description of the system and the design, and for Type 2 reports the operating effectiveness, of your controls. Pease Bell performs SOC 1, SOC 2, and SOC 3 examinations.
This page covers the examination itself. If you are earlier in the process and need help scoping, closing control gaps, or preparing evidence before an auditor arrives, see our SOC readiness and gap-assessment services under risk advisory. Readiness work helps you get prepared; the examination is the independent test that produces the report your customers receive. Independence requirements govern how the two relate, so we discuss scope and roles at the outset of every engagement.
Our SOC Examination Services
SOC 1 Examinations
We examine controls at service organizations that are relevant to user entities’ internal control over financial reporting, such as payroll, claims processing, or loan servicing, under SSAE 18.
SOC 2 Examinations
We examine controls relevant to security and, as selected, availability, processing integrity, confidentiality, and privacy, measured against the AICPA Trust Services Criteria, for customers evaluating data and operational risk.
SOC 3 Reports
We issue general-use SOC 3 reports based on the Trust Services Criteria for organizations that want a summary report they can share publicly or with prospects.
Type 1 Reports
We report on the fairness of your system description and the suitability of control design as of a specific date, often used as a first report or for newly implemented systems.
Type 2 Reports
We test whether controls operated effectively over a review period and include the tests performed and results in the report, which is what many customers and auditors ultimately expect.
Scoping and Report Planning
We help define the system boundaries, applicable criteria or control objectives, subservice organizations, and review period before fieldwork so the report answers what your customers are asking.
Challenges We Help You Address
- ✓Customers or prospects requiring a SOC report before signing a contract
- ✓Unclear whether a SOC 1 or SOC 2 report is the right fit
- ✓Deciding between a Type 1 and Type 2 report for a first examination
- ✓Subservice providers, such as cloud hosts, that complicate report scope
- ✓Customer auditors needing a report period that covers their fiscal year
Frequently Asked Questions
What is the difference between SOC 1 and SOC 2?
A SOC 1 report addresses controls at a service organization that are relevant to its customers’ internal control over financial reporting, and is mainly used by those customers’ financial statement auditors. A SOC 2 report addresses controls relevant to security, availability, processing integrity, confidentiality, or privacy, evaluated against the AICPA Trust Services Criteria, and is typically used by customers assessing operational and data risk.
What is the difference between a SOC 2 Type 1 and Type 2 report?
A Type 1 report gives an opinion on the system description and whether controls are suitably designed as of a specific date. A Type 2 report covers the same areas plus whether the controls operated effectively throughout a review period, and includes the auditor’s tests and results. Type 2 reports provide more evidence and are what many customers expect over time.
What is a SOC 3 report?
A SOC 3 report is a general-use report based on the same Trust Services Criteria as SOC 2, but without the detailed system description, tests, and results. Because it is less detailed, it can be shared publicly, such as on a website, or with prospects who do not have a nondisclosure agreement. Customers who need detail usually still request the SOC 2 report.
Who can perform a SOC audit?
SOC examinations are attestation engagements under AICPA standards, so the report must be issued by an independent licensed CPA firm. Other firms may offer readiness consulting or compliance software, but they cannot issue the SOC opinion. Because independence rules apply, organizations should discuss with their CPA firm how any readiness assistance relates to the examination before work begins.
Related services & industries
Contact Us
Tell us about your organization and a member of our team will be in touch.