SAS 70 or SSAE sixteen or SOC - Which Report Must you Use?

Improve Has Arrived

What has long been generally known as a "SAS 70 Report" has long been refreshed by the American Institute of Qualified Community Accountants (AICPA) with new steerage for reporting on services companies. This direction changed SAS 70 for reports covering intervals ending on or soon after June fifteen, 2011.

The original intent of a SAS 70 report was to communicate with auditors with regards to money assertion assertions. Over time, SAS 70 morphed into a promoting Software; a "certification" for security, availability, as well as other assertions unrelated to controls above fiscal reporting. As businesses are getting to be significantly concerned about risks past economic reporting, a whole new suite of stories was required to fulfill the requires of such corporations.

The AICPA's response was to offer alternative options for reviews meant to supply buyers of third-social gathering companies comfort and ease all over Those people operational controls applicable to them: stability, processing integrity, availability, confidentiality and privateness. These solutions are encompassed in the new AICPA Services Corporation Management (SOC) experiences. Rather than having 1 report designed for monetary reporting, there now are three versions of a Service Organization Control Report---SOC one, SOC two, and SOC three experiences, Each individual serving a definite reason:

SOC one: Report on Controls in a Provider Firm Appropriate to Consumer Entities' Inner Handle above Economic Reporting offers ease and comfort about financial reporting and transaction services; essentially, what a SAS 70 was at first meant to do. SOC one engagements are done in accordance with Assertion on Expectations for Attestation Engagements (SSAE) 16, Reporting on Controls at a Service Organization.

SOC two: Report on Controls do i need a soc 2 report in a Provider Firm Pertinent to Safety, Availability, Processing Integrity, Confidentiality and/or Privacy utilizes predefined conditions and handles a number of in the five key system attributes of stability, availability, processing integrity, confidentiality, and privateness. SOC two engagements deal with controls in the organization that relate to operations and compliance.

SOC three: SysTrust for Assistance Businesses Report makes use of exactly the same attributes given that the SOC two report. The SOC 3 report is really a standard-use report that gives just the auditor's report on whether or not the technique attained fundamental trust products and services standards, leaving out the thorough program and testing descriptions. The SOC three report also permits the Group to make use of the SOC 3 seal on its Web-site.

Critical Alterations to Reporting

The new standards alter the articles in the report, along with the reporting system for that support Business. The demanded improvements supply your Business a possibility to differentiate and to offer improved relevancy to your purchasers. Provider companies are needed to give a description of the process. This description is much more encompassing than the description with the controls necessary by a SAS 70. The new description delivers more details associated with the people today, procedures, and technologies set up to realize management's Command goals. The description also incorporates more details on the courses of transactions processed. An additional improve would be the requirement which the Firm provide a published assertion that is a vital part of the report. The assertion by administration will show its obligation for that accuracy of The outline in the procedure along with the evaluation standards for the basis of constructing the assertion.

Picking Your SOC Report

When deciding upon a Provider Organization Regulate Report (a SOC report), think about your viewers. Who will use this report and for what intent? Does your audience involve auditors who need to have details regarding your controls and the test success, or will a normal-use report fulfill their needs?

While you changeover from a SAS 70 report back to a fresh SOC report, additionally, you will want to take into account your system and the categories of transactions you process. Solutions to those queries might help ensure you get ready the SOC report which best fits your Group.