Download Presentation - Plante Moran

More documents

Recommendations

Info

New Report Structure SAS 70 1. Independent Service Auditor’s Report 2. Description of Controls 3. Control Objectives and Related Controls 4. Other Information Provided by the Service Organization SOC 1. Auditor’s Opinion 2. Management’s Assertion 3. Description of the Systems 4. Information provided by the Service Auditor 5. Information provided by the Service Organization 26
Management Assertion (additional requirements under new standard) The SSAE 16 standard requires management of the service organization to provide the service auditor with a written assertion. Management "asserts" to a number of clauses, such as the following: That management's description of the service organization's "system" fairly presents the service organization's system that was designed and implemented at either a specific date (SSAE Type 1 report) or implemented throughout a specified time period (SSAE 16 Type 2 report). The control objectives stated in management's description of the service organization's system were suitably designed to achieve those control objectives at either a specific date (SSAE 16 Type 1 report) or designed throughout a specified time period (SSAE 16 Type 2 report) to achieve those control objectives along with having them operate effectively throughout the specified time period. The criteria used to effectively making these assertions, which again, are additional statements and supporting references regarding risk factors relating to controls and control objectives and (for a SSAE 16 Type 2 report) that the controls were consistently applied. 27
Page 1 and 2: Service Organizations Control (SOC)
Page 3 and 4: Introduction Many companies functio
Page 5 and 6: Service Organizations that need a S
Page 7 and 8: Benefits to User Organization User
Page 9 and 10: Reasons for New Standard Clear con
Page 11 and 12: SOC - Types of Engagements Regardle
Page 13 and 14: SOC 1 Control Objective Examples IT
Page 15 and 16: SAS 70 vs. SSAE 16 Report Date Plan
Page 17 and 18: Preparing for a SOC Review (cont.)
Page 19 and 20: Preparing for a SOC Review (cont.)
Page 21 and 22: Case Study - Risk Assessment Object
Page 23 and 24: During the SOC Review Types of Test
Page 25: Reporting Types of Opinions Unqual
Page 29 and 30: SOC Seals & Logos There are three

Download Presentation - Plante Moran

Create successful ePaper yourself

Delete template?

Save as template?