Abstract
Many organizations outsource their business processes to service providers. The service providers must be audited by certified public accountants (CPA) to check the design and operation of their security procedures and internal controls (IC). These reports are called service organization control (SOC) reports. Through these reports, a CPA can express an opinion on the ICs of the services provider. SOC reports come in several different formats depending on the circumstance. As outsourcing becomes more popular and computer crimes increase, SOC reports will be more important. The objective of this chapter is to explain SOC reports, how they are compiled, and how they are used. Accordingly, this chapter gives a technical description of SOC reports so that professionals in the areas of accounting, auditing, and risk management can understand the purpose, application, and value of SOC reports. The authors conclude that as managers put more information on the cloud, SOC reports will fill an important need since they inform managers about risk management issues such as internal controls.
TopIntroduction
With most organizations accumulating big databases, managers are aware of susceptibility to data breaches. Accordingly, organizations and auditors may require proof that a third-party cloud service company is taking reasonable precautions to protect their data and information. Even if a cloud service processor does not handle financial data but hosts various other types of transactions and processes, a Service and Organization Control (SOC) report may mitigate the risk and impact of a data breach (Shedari, 2013).
The triple interaction framework of internal controls refers to a set of interactions between a service organization, client, and CPA firm, to foster confidence in the internal controls of the service organization. As the knowledge economy expands, more organizations will outsource to cloud-based service providers. This requires an audit of the service organization’s internal control to reduce the probability of material errors and fraud. In the triple interaction model of internal controls, each organization is represented by a rectangle, with arrows showing interactions between the three agents. The client in Figure 1 is receiving payroll (PR) services from the service organization. Accordingly, the client’s CPA must audit the internal controls over PR at the service organization to be able to complete the client’s audit.
Figure 1. Triple interaction framework related to SOC reports
SOC reports are relatively new, having started in 2011. They were created by the American Institute of Certified Public Accountants (AICPA). SOC reports can only be issued by a CPA (Certified Public Accounting) firm as the reports are the result of an attestation engagement. An attestation engagement is an examination performed by an independent CPA who checks the system to see if it conforms to industry standards. In addition, similar to auditing, CPA firms that provide SOC reports must commit to a peer review process (Maloney + Novotny, 2020).
A SOC report (not to be confused with the acronym for security operations center) is a way to verify that a third-party processor, such as a cloud service, is following best or reasonable practices before outsourcing a business function to that third party. SOC reports enable managers and auditors to feel confident that service providers are operating with proper security and internal controls (ICs). Also, auditors will refer to these reports when analyzing the internal control design and operation during an audit of a company that uses a third-party processor for some of their business functions.
A third-party processor should pursue SOC reports if the services impact a client’s financial or operational reporting. For example, if a cloud service hosts software and databases that process clients’ accounts receivable, billing, and collections data, this affects the client’s cash and accounts receivable on the balance sheet (financial reporting). Accordingly, a SOC report is appropriate. Another reason why outside processors pursue SOC reports is if their clients or auditors ask for a “right to audit.” Without SOC reporting, this could be a costly and time-intensive process, especially if several clients submit similar requests related to internal controls and cybersecurity (ISACA, 2011). The objective of this chapter is to review SOC reports and the issues related to their completion such as internal controls, types of SOC reports, and audit procedures.
Key Terms in this Chapter
Certified Public Accountant (CPA): An individual who holds a state license which allows them to practice auditing services. They also do a wide variety of other financial services such as tax, consulting, and other financial statement services.
Auditing: The process of examining compliance with regulations or other standards. Financial auditing is usually done by external CPAs, internal auditors can assist the external CPAs. All publicly traded companies in the United States must be audited once per year.
Service Organizations: Organizations that provide services for clients. In the context of this chapter, service organizations provide a variety of financial and information type services to clients such as cloud storage and data processing.
Service Organization Control (SOC) Reports: Reports completed by CPAs that express an opinion on the design and operation of a service organization’s security and ICs. There are several types of SOC reports.
Cybersecurity: Security of computer-based systems. These systems employ a wide variety of methods such as encryption, firewalls, backup, and internal controls.
Attestation Engagement: An examination performed by an independent CPA who checks the system to see if it conforms to industry standards.
Internal Controls: Controls that assure the privacy, accuracy, and security of data and information. These controls can be broad-based or specific to a particular application.
Information Systems: Any system that reports information to the management of an organization. These systems also receive and store data as well as process and output information.
Sarbanes-Oxley (SOX) Act: Passed in 2002 after a series of corporate frauds, SOX requires management of publicly traded companies to take responsibility for financial statements. It also requires auditors to express an opinion on a company’s ICs (section 404) as well as their financial statements. SOX created the Public Company Accounting Oversite Board (PCAOB) to regulate the auditing profession.