Download Presentation - Plante Moran

Service Organizations Control (SOC) Report
SAS 70 to SSAE 16: What Companies Need to Know
Session #: 373
IASA 85 TH ANNUAL EDUCATIONAL CONFERENCE & BUSINESS SHOW

Introduction
Sharon L. Gipson, CPA
Director II and Asst. General Auditor
Blue Cross Blue Shield of Michigan
SGipson@bcbsm.com
(313) 225 8077
Raj J. Patel, CISM
Partner
Plante Moran
Raj.Patel@PlanteMoran.com
(248) 223 3428
2

Introduction
Many companies function more efficiently and
profitably by outsourcing tasks or entire functions
to other organizations (i.e., service organizations)
that have the personnel, expertise, equipment or
technology to accomplish these tasks.
As part of these services, a service organization
will often collect, process, transmit, store,
organize, maintain, and dispose of information for
its customers.
3

Introduction
Although a company may outsource tasks to a service organization, company management retains its
responsibility for the outsourced tasks and the manner in which they are performed. For this reason, it is
important for service organizations to provide their customers with sufficient information about the system
used to perform outsourced tasks. In order to provide customers with assurance that stakeholder
expectations are met, a service organization needs a process for:
Developing procedures to identify risks resulting
from its outsourcing relationships.
Assessing those risks.
Identifying controls at the service organizations
that address the risks.
Evaluating the suitability of the design and
operating effectiveness of the service
organization’s controls.
Implementing and maintaining controls to address
risks not addressed by controls at the service
organization.
4

Service Organizations
that need a SOC review
Medical & insurance claims
processors
Cloud Computing / Software as a
service
Data Center Hosting
Payroll processing
Loan servicing
Mortgage servicers
Custodians for investment
companies
Sub-service Organizations
5

Benefits to Service Organization
Competitive Differentiator - A Service Auditor's Report with an unqualified opinion issued by an
independent accounting firm differentiates the service organization from its peers by demonstrating the
establishment of effectively designed controls.
Build Trust - A Service Auditor's Report also helps a service organization build trust with its user
organizations (i.e., customers) and sometimes prospective clients.
Time Saver - Without a current Service Auditor's Report, a service organization may have to entertain
multiple audit requests from its customers and their respective auditors. Multiple visits from user
auditors can place a strain on the service organization's resources.
Consistency - A Service Auditor's Report ensures that all user organizations and their auditors have
access to the same information to satisfy the user auditor's requirements.
Independent Qualified Assessment - SOC engagements are performed by control oriented
professionals who have experience in accounting, auditing, and information security. A SOC
engagement allows a service organization to have its control policies and procedures evaluated and
tested by an independent party.
Control Improvements - Very often this process results in the identification of opportunities for
improvements in operational areas.
6

Benefits to User Organization
User organizations that obtain a Service Auditor's Report from their service organization(s) receive
valuable information regarding the service organization's controls and the effectiveness of those
controls (in the case of a Type II report). The user organization receives a detailed description of the
service organization's controls and an independent assessment of whether the controls were placed in
operation, suitably designed, and operating effectively.
For controls over financial reporting, user organizations may provide a Service Auditor's Report to their
auditors. This will greatly assist the user auditor in planning the audit of the user organization's
financial statements. Without a Service Auditor's Report, the user organization would likely have to
incur additional costs in sending their auditors to the service organization to perform their procedures.
7

SAS 70 Background
Developed by the American Institute of Certified Public
Accountants (AICPA)
Type I
Point in time assessment
Description of controls presents
fairly in all material aspects
Controls designed to achieve
specific control objectives
Type II
Specific audit period
Description of controls presents
fairly in all material aspects
Controls designed to achieve
specific control objectives
Detailed testing of controls
effectiveness to provide reasonable
assurance
8

Reasons for New Standard
Clear confusion on use of SAS 70 - Separate reporting for service organizations that
impact financial reporting from those that do not
Security, availability, confidentiality, processing integrity, and privacy are more of a
concern
New regulations such as Sarbanes-Oxley
Federal privacy regulations such as GLBA, HIPAA, FERPA, FISMA, etc.
Advances in technology (online portals, mobile, cloud, etc.)
Increase in outsourcing tasks to service organizations
9

SOC – Types of Engagements
SOC engagements are designed to meet the needs of user entities and other
stakeholders by providing service organizations with criteria for describing their
systems, criteria for evaluating the suitability of design and operating effectiveness of
the service organization’s controls, and an independent CPA’s opinion on the
description of the system and the design and operating effectiveness of the service
organization’s controls.
There are three SOC report options:
SOC 1 reports are performed in accordance with the Statement of Standards for
Attestation Engagements (SSAE 16) and focus solely on controls at the service
organization that are relevant to the audit of a user’s financial statements.
SOC 2 reports are performed under Attestation Standards (AT) Section 101 “Attest
Engagements”, and are based on the AICPA’s Trust Services Principles and Criteria.
These reports address one or more of the following key system attributes: security,
availability, processing integrity, confidentiality, and privacy.
There are
two types of
reports for
both SOC 1
and SOC 2
examination
s. A Type 1
and Type 2
SOC 3 reports use the same Trust Services Principles and Criteria as SOC 2. Like SOC
2, SOC 3 reports can address one or more of the five Trust Services Principles and
Criteria. SOC 3 reports differ from SOC 2 reports in that they are for general use, without
a description of the service auditor’s tests and results.
10

SOC – Types of Engagements
Regardless of whether a SOC 1 or 2 is chosen, there are two types of SOC
examinations. A Type I examination provides assurance over the design of controls
and a Type II examination provides assurance over the design of controls and their
operating effectiveness. SOC 3 examinations provide assurance over both the design
of controls and their operating effectiveness (i.e., Type II).
Type I
Coverage A Type I report examines the suitability of the
design of controls in meeting specified control
objectives or the applicable trust services
criteria, as of a specified date (e.g. June 30).
Control Design An opinion is given on (1) the fairness of the
presentation of management’s description of
its system, and (2) the suitability of the design
of controls in meeting the specified control
objectives (SOC 1) or trust services criteria
(SOC 2 and 3).
Type II
A Type II report examines the suitability of the
design of controls, and the operating
effectiveness of the controls over a specified
period (e.g. January 1 to June 30).
An opinion is given on (1) the fairness of the
presentation of management’s description of
its system, and (2) the suitability of the design
of controls in meeting the specified control
objectives (SOC 1) or trust services criteria
(SOC 2 and 3) during the period specified.
Control
Effectiveness
N/A
An opinion is given on the (3) operating
effectiveness of the controls in meeting the
specified control objectives (SOC 1) or trust
services criteria (SOC 2 and 3) during the
period specified.
11

Service Organization Controls Basics
SOC I
(SSAE 16)
Title Report on Controls at a
Service Organization
Relevant to User Entities’
Internal Control over
Financial Reporting (SSAE
16)
SOC 2
(AT 101)
Report on Controls at a
Service Organization
Relevant to Security,
Availability, Processing
Integrity, Confidentiality or
Privacy
SOC 3
(AT 101)
Trust Services Report for
Service Organizations
Type Of Services
Provided
Controls relevant to user
entities’ internal control over
financial reporting
Controls relevant to security,
availability, processing
integrity confidentiality, or
privacy
Controls relevant to security,
availability, processing
integrity confidentiality, or
privacy
Report Format Type I or Type II Type I or Type II Type II only
Who Will Use The
Report?
User Entities,
User Entities’ Auditors
User Entities, User Entities’
Auditors, Prospective User
Entities
Anyone
Is The Report
Available For
Public Use?
No No Yes
12

SOC 1 Control Objective Examples
IT General Controls
Information Security
Logical Access
Environmental Controls
Physical Security
Data Backup and Recovery
System Development and Change
Management
System Monitoring and Maintenance
Processing Controls
Claims Receipt
Claims Output
Master File Maintenance
Reconciling Provider Payment
Reporting
13

SOC 2 and 3 Trust Principles
1. Security
2. Availability
3. Processing Integrity
4. Confidentiality
5. Privacy
Management
Notice
Choice and consent
Collection
Use, retention, disposal
Access
Disclosure to third parties
Security for privacy
Quality
Monitoring and enforcement
14

SAS 70 vs. SSAE 16
Report Date
Planning
SAS 70
-Scope
-Description of Control
Operating Effectiveness
Design
Subsequent Event
Mgt. Report Letter &
report
Start of Audit Period
End of Audit Period
Delivery
SSAE 16
-Scope
-Description of Control
Management Assertion
Risk Assessment
Operating Effectiveness
Design
Subsequent Event
Mgt. Report Letter &
report

Preparing for a SOC Review
System Description
Management of the service organization is responsible for preparing the
description of the service org’s system, including the completeness, accuracy,
and method of presentation of the description.
16

Preparing for a SOC Review (cont.)
Defining Scope of Engagement
Management of the service org considers which services, business units,
functional areas, or applications are likely to be relevant to its user entities.
Management also considers whether the service org has any contractual
obligations to provide the report to one or more of its user entities, including
frequency.
These may be separate entities from the service org or may be entities related to
her service org. A service org that uses a subservice org may use the carve-out
method or the inclusive method to present info about services provided by the
subservice org in its description of the service org’s system.
Determine period - SSAE No. 16 states that a type II report that covers a period
of less than six months is unlikely to be useful to user entities and their auditors.
17

Preparing for a SOC Review (cont.)
Service Organization Management Responsibilities
Management of the service organization is responsible for the following:
18

Preparing for a SOC Review (cont.)
Use of Internal Audit work
SSAE No. 16 states that if the service org has an internal audit function, the
service auditor should obtain an understanding of the nature of the internal
audit function’s responsibilities and activities to determine whether the
internal audit function is likely to be relevant to the engagement.
19

Case Study - Risk Assessment
Objective: C ontrols provide reasonable assurance that physical access to computer
equipment, storage media, and program documentation is restricted to authorized
personnel.
What Can Go Wrong:
Relevance
Probability:
Impact:
Daily Weekly Monthly Quarterly Annually
No Inmpact Nuisance Significant Crisis
Key Controls
1. Encrypted Mobiles devices / USB
drives
2. C ard controlled data center access
3. Receptionist during business hours
1. C omputer equipment (including mobile devices) lost or stollen.
2. D ata storage U SB drives lost or stollen
3. U nauthorized access to data center
4.
5.
Designed
Effectively
Operating
Effectively
Test Results
Yes Partially Exceptions Noted
Yes
Yes
No exceptions
noted
Yes
Yes
No exceptions
noted
Conclusion Meets / Does Not Meet Risks O bjectives
20

Case Study - Risk Assessment
Objective:
What Can Go Wrong:
Relevance
Key Controls
Probability:
Impact:
Daily Weekly Monthly Quarterly Annually
No Inmpact Nuisance Significant Crisis
Designed
Effectively
Operating
Effectively
Test Results
Conclusion Meets / Does Not Meet Risks O bjectives
21

During the SOC Review
Timing of Audit Testing
22

During the SOC Review
Types of Tests
• Inquiry – Lowest level of assurance, with collaboration with one of the three types of
tests below.
• Observation – Consider multiple observations during the examination period,
especially if no documentary evidence exists
• Inspection of documents, reports, or electronic files that contain evidence of the
performance of the control
• Re-performance of the control
23

Reporting
Deviations / Control Deficiencies
If deviations have been identified, the service auditor’s description of tests and results
should identify the extent of testing performed by the service auditor that led to the
identification of the deviations, including:
# of items tested
Number and nature of deviations noted
If deviations have been identified, it may be helpful to users of the report for management to
disclose, to the extent known
Causative factors for the deviation
Controls that mitigate the effect of the deviation
Corrective actions taken
Other qualitative factors that would assist users in understanding the effect of the
deviations
Information provided by management about controls that mitigate the effect of deviations or
corrective actions should not include forward-looking info, such as future plans to implement
controls.
24

Reporting
Types of Opinions
Unqualified Opinion – The controls are designed and operating effectively. They meet
the needs of the objectives.
Qualified Opinion - When the service auditor has determined that the controls do not meet
the objectives (i.e., poorly designed, not operating effectively).
Disclaimer
• Refusal to provide a written assertion
• Refusal by management to provide a representation reaffirming their
• assertion
• Information provided by the Service Organization
25

New Report Structure
SAS 70
1. Independent Service
Auditor’s Report
2. Description of Controls
3. Control Objectives and
Related Controls
4. Other Information Provided
by the Service Organization
SOC
1. Auditor’s Opinion
2. Management’s Assertion
3. Description of the Systems
4. Information provided by the
Service Auditor
5. Information provided by the
Service Organization
26

Management Assertion
(additional requirements under new standard)
The SSAE 16 standard requires management of the service organization to provide the
service auditor with a written assertion.
Management "asserts" to a number of clauses, such as the following:
That management's description of the service organization's "system" fairly presents the
service organization's system that was designed and implemented at either a specific date
(SSAE Type 1 report) or implemented throughout a specified time period (SSAE 16 Type 2
report).
The control objectives stated in management's description of the service organization's
system were suitably designed to achieve those control objectives at either a specific date
(SSAE 16 Type 1 report) or designed throughout a specified time period (SSAE 16 Type 2
report) to achieve those control objectives along with having them operate effectively
throughout the specified time period.
The criteria used to effectively making these assertions, which again, are additional
statements and supporting references regarding risk factors relating to controls and control
objectives and (for a SSAE 16 Type 2 report) that the controls were consistently applied.
27

Management Assertion
Written assertion from the subservice organization if inclusive method is
used
28

SOC Seals & Logos
There are three AICPA SOC logos:
• one (“Service Organization SOC Logo”)
for service organizations obtaining a
SOC report (i.e., SOC 1, SOC2 and/or
SOC 3),
• One (“SOC 3 Seal”) for service
organizations obtaining an unqualified
SOC 3 report, and
• One (“Service Auditor CPA SOC Logo”)
for licensed CPAs performing SOC
examinations.
29

Please Complete the Session Evaluation Form on
the Conference App and Include Your Conference
Registration ID# to be Included in a Drawing for a
Free Conference Registration for the 2014 Annual
Conference!
NOTE: Your Conference Registration ID# is Located at the
Bottom Left Hand Corner of Your Badge.
IASA 85 TH ANNUAL EDUCATIONAL CONFERENCE & BUSINESS SHOW