.webp?width=2169&height=526&name=Compass%20regular%20transparent%20website%20(1).webp "Compass IT Compliance Logo")
-1.webp?width=2169&height=620&name=Compass%20regular%20transparent%20website%20smaller%20(1)-1.webp "Compass IT Compliance")
SOC Reporting Services
System & Organization Controls (SOC) reports serve as a testament to regulators, business associates, and customers that your organization has established and enacted suitable internal controls. Whether you are preparing for your first SOC examination or have a history of producing these reports, Compass has the expertise to help you deliver a high-caliber SOC report that is instrumental in cultivating business trust.
.webp?width=200&height=28&name=Asplundh%20White%20(1).webp){kind=small}
.webp?width=114&height=70&name=Edenred_Logo.svg%20(1).webp){kind=logo}
Compass Makes SOC Reporting Simple
In today's business landscape, where reliance on outsourcing is increasing for profitability and efficiency, the importance of trust in data protection practices has never been more critical. As you share sensitive data with third parties, the gap in trust can widen, prompting customers, business partners, and regulators to seek reassurance about your data protection practices. Attestation reporting, particularly SOC reporting, is instrumental in bridging this trust gap.
SOC and other attestation reports from Compass are more than just compliance documents; they are tools to build confidence among your stakeholders. They demonstrate that appropriate controls are in place for both your business processes and information technology (IT) to safeguard financial and sensitive client data. Below is a visual representation of the Compass process for conducting SOC reporting services. This diagram outlines our methodical approach, from the initial selection of Trust Services Criteria (TSC) to the final stages of reporting with our independent CPA firm, Compass Assurance Team. This strategy provides a clear overview of each step involved, illustrating how we work closely with our clients to ensure a thorough, efficient, and tailored SOC reporting experience. The process is designed to not only meet but exceed the specific compliance needs of your organization, ensuring both accuracy and reliability in your SOC reports.
.webp?width=1100&height=195&name=COMBINED%20C%20(1).webp)
Industries We Serve
Compass provides specialized SOC audit services tailored to a broad spectrum of industries. Our expertise extends to supporting a diverse range of organizations, including software-as-a-service (SaaS) vendors, cloud service providers, managed service providers (MSPs), data centers, supply chain companies, and other various business-to-business (B2B) service organizations.
Our capabilities also encompass aiding loan servicers, payroll processing firms, as well as operators of employee benefits and retirement plans. We are well-equipped to assist registered investment advisors and trust departments, among others, ensuring comprehensive compliance and audit solutions across multiple sectors. Our customers encompass healthcare organizations, financial technology (FinTech) companies, and venture capital (VC) firms, all of which face unique data security and compliance challenges. Other industries we support include:
Compass Assurance Team
The Compass Assurance Team, affiliated with Compass IT Compliance and recognized by the AICPA, is a fully licensed and accredited CPA firm specializing in SOC reporting. Through a strategic partnership with Compass IT Compliance, clients are provided with comprehensive support throughout the entire SOC reporting process. This collaboration entails working closely with Compass IT Compliance on readiness initiatives aimed at fostering a favorable outcome—an unqualified opinion—in the completion of the SOC report alongside the Compass Assurance Team. This dual organization structure ensures a division of responsibilities, mitigating any potential conflicts of interest and enabling a smooth, integrated flow of the entire project.
What is a SOC Report?
System & Organizational Controls (SOC) reports are internal control reports that outline the services that are being provided by a service organization and the controls related to the service that is being offered. This provides valuable information to potential customers and allows the service organization to build trust and confidence around their service offerings. A Service Auditor's Report can help a service organization to:
- Build trust with customers
- Be a key differentiator to prospective clients
- Ensure that all requests from user organizations and their auditors rely on the SOC report
SOC reports are intended to build consumer trust, and are required or beneficial for organizations such as: data centers, loan servicing, payroll, medical claims, SaaS, software developers, etc. The Association of International Certified Professional Accountants (AICPA) breaks down SOC reports into the following categories:
SOC 1 Report
A SOC 1 report evaluates a service provider's internal controls relevant to a client's financial reporting. It's issued for the client's auditors to assess and endorse the financial statements confidently. The report's usage is strictly limited to those auditors and the client's management.
SOC 2 Report
A SOC 2 report examines a service provider's data controls regarding the 5 Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. The report is intended for a professional audience, including auditors and shareholders.
SOC 3 Report
The SOC 3 report is intended for public sharing to enhance consumer confidence in an organization's controls. While covering the same areas as SOC 2, SOC 3 excludes confidential information in the final report, making it suitable for broader distribution.
Type 1 vs Type 2 SOC Reports
SOC reports come in two distinct types: Type 1 and Type 2. This distinction is important for organizations to choose the right report that aligns with their specific auditing and compliance needs:
Type 1 Report
The Type 1 report is a report on management's description of the system(s) in scope and the suitability and design of the controls related to the Trust Services Criteria (TSC) at a point in time.
Type 2 Report
The Type 2 report is more detailed. The Type 2 report includes the statements above, related to a Type 1 report, but takes it a step further to outline the operating effectiveness of the controls in place over a period of time, not less than 6 months.
SOC Reporting Frequently Asked Questions
A SOC (System and Organization Controls) report is an independent audit document that evaluates an organization’s controls related to financial reporting, security, availability, processing integrity, confidentiality, or privacy. There are different types of SOC reports, including SOC 1, which focuses on financial reporting controls, and SOC 2, which addresses trust service criteria like security and confidentiality. Additionally, a SOC 3 report is a simplified version of SOC 2, designed for broader distribution and public consumption, providing assurance about the organization's controls without the detailed technical information included in a SOC 2 report. These reports collectively help organizations build trust with clients and stakeholders.
A SOC report is prepared by a licensed CPA firm or agency accredited by the American Institute of Certified Public Accountants (AICPA). These professionals conduct a thorough assessment of the organization's controls, testing them against specific criteria outlined by the American Institute of Certified Public Accountants (AICPA). The resulting report reflects the auditor's findings and provides assurance about the organization's compliance with those criteria.
A SOC 2 report is typically valid for 12 months from the end date of the audit period. However, its relevance can diminish over time as systems, processes, and threats evolve. For this reason, organizations often aim to obtain new SOC 2 reports annually to maintain continuous assurance for their clients and stakeholders.
A SOC 2 report should be updated at least annually to ensure it reflects the organization’s current controls and operating environment. Regular updates are especially important for businesses in industries with rapidly changing compliance requirements or evolving cybersecurity threats. Frequent updates help maintain trust and demonstrate a commitment to ongoing compliance and security.
Related Resources
Educational content and resources related to our SOC Reporting services: