Sooner or later, most service organizations get the email: a customer wants proof that your controls work. Often the request simply says “audit,” which leaves you guessing.
We recently walked through that confusion in a Health Care Administrators Association (HCAA) webinar, From Audit Basics to Vendor Due Diligence: What Every Organization Should Know. Our first tip: when someone asks for an audit, ask what they need assurance over.
A System and Organization Controls (SOC) report is an independent CPA firm’s opinion on the internal controls at a service organization, meaning a company that performs services for other companies. The American Institute of Certified Public Accountants (AICPA) sets the standards for the SOC suite of services.
The two most common types are:
Like any audit, a SOC examination provides reasonable assurance based on sample testing, not absolute assurance.
A SOC 1 audit examines a service organization’s controls that are likely to be relevant to its customers’ internal control over financial reporting (ICFR). In short, do your customers rely on you for numbers that end up in their financial statements?
Healthcare third-party administrators (TPAs) are a classic example. TPAs collect premiums, pay providers, and manage funds for self-funded employers. That work directly affects claims expenses and reserves on their customers’ books. SOC 1 reports are restricted to use, meant for customers and their auditors rather than the public.
Both SOC 1 and SOC 2 reports come in two types:
A Type 2 shows controls working throughout the period, so it provides stronger assurance and is what most customers request. We often suggest Type 1 as a first step.
A SOC 2 evaluates controls against the AICPA’s trust services criteria: security (always included), availability, processing integrity, confidentiality, and privacy. It fits vendors that store or process sensitive data, such as claims processing software providers.
Related options can save time and money:
We’ve also worked with clients whose customers asked for a SOC 2 and were satisfied once we added IT controls to an existing SOC 1.
For a first-year engagement, we typically see three phases:
Most SOC reports disclose a few minor exceptions, each with a written management response providing more context. That’s very normal and usually more of an indicator of a quality audit than something to worry about. Of course, the nature of the exceptions matters more than how many there are.
Confirm what your customer actually needs. If a customer brings in $5,000 a year, a $30,000 audit may not make sense. Sometimes a different report will do, or the customer helps share the cost. Some of our first conversations with organizations end with advice on how to go back to the customer rather than with an engagement. We’re fine with that.
Learn how an independent rate review helped a utility reseller build customer trust.
Choosing between a SOC 1 and SOC 2, or Type 1 and Type 2, is easier for someone who performs these audits every day. Our SOC Reporting team can help you:
Talk to an expert about your SOC reporting needs.
Usually, it depends on your customers. Type 2 reports typically cover 12 months and repeat annually. SOC reports are driven by customers rather than required by law, so some organizations issue one every other year.
Yes. SOC controls are designed around each organization’s risks rather than a fixed checklist, so they can be tailored to a team with only one or two IT staff. Basics like segregation of duties still apply.
Costs depend on scope, size, and provider. Across reputable firms nationally, SOC 1 and SOC 2 engagements generally range from about $20,000 to $60,000.