System and Organization Controls (SOC) Auditing

Build trust and credibility with customers and prospects, improve data security and regulatory compliance, and unlock market opportunities with a SOC audit.

The American Institute of Certified Public Accountants (AICPA) has provided the solution to demonstrate the reliability of your system of controls and to provide assurance to your customers by providing three System and Organization Control (SOC) reporting options, SOC 1, SOC 2 and SOC 3.

Demonstrate Your Commitment to Securing Customer Data and Privacy

SOC audits provide comprehensive, industry–standard frameworks for reassuring customers that your security processes and controls are safeguarding their data effectively.

SOC audits enable cloud service providers to pursue larger, more compelling business opportunities from clients with more robust cyber security expectations.

The audit process also enhances your ability to conduct ongoing risk assessments, and to adjust security policies and procedures as needed

SOC Audit Types

We provide different types of SOC audits to meet your reporting needs:

SOC 1

A SOC 1 report is a formal audit of a company-specific service provider’s controls that affects their customer’s internal control over financial reporting.

SOC 1 Reports

SOC 2

A SOC 2 report provides service organizations with an opinion on their compliance with a standardized set of industry neutral controls based on the AICPA’s Trust Services Principles — security, availability, processing integrity, confidentiality, and privacy. A SOC 2 report includes the security principle, known as the common criteria, with the remaining optional principles depending on the company’s needs.

SOC 2 Reports

SOC 3

A SOC 3 report is intended to be used as a marketing tool to an unrestricted audience, such as potential customers, investors, or other stakeholders. Similar to a SOC 2 report, but less comprehensive, the SOC 3 report provides a generalized opinion on controls related to one or more of the Trust Service Principles.

SOC 3 Reports

Streamlining Compliance: The Advantages of Combining SOC Audits and ISO/IEC 27001 Certification

Overall, SOC reports reassure your customers they can rely on you to protect their data against fraud risk, unauthorized access and use, loss, and privacy violations. Companies with international customers and operations can save time and costs by combining a SOC audit with an ISO 27001 certification.

Our SOC Practice Leadership

Jeff Stark

Audit Partner

Brian Beal, CISSP, CISA

Partner, Risk Assurance Services

NEWS, EVENTS, AND INSIGHTS

Related SOC Resources

Insight

System and Organization Controls (SOC) Auditing

Demonstrate Your Commitment to Securing Customer Data and Privacy

SOC Audit Types

SOC 1

SOC 2

SOC 3

Streamlining Compliance: The Advantages of Combining SOC Audits and ISO/IEC 27001 Certification

Our SOC Practice Leadership

Jeff Stark

Brian Beal, CISSP, CISA

Related SOC Resources

Everything You Must Know About SOC 1 Reports

Getting Your First SOC 1 Report

SOC 1 Reporting for SaaS Companies

ISO 27001 vs. SOC 2: Do You Need Both?

Improving Cloud Security Controls Before a SOC 2 Audit

SOC 2 & Risk Management

Your First SOC 1 Audit: Essential Prep Steps for Success

Understanding Bridge Letters for SOC 2: What They Are and Why They Matter