CPAs & ADVISORS STRATEGIC ALLIANCE WEBINAR SERIES WHICH SOC REPORT IS RIGHT FOR YOUR CLIENT? June 20, 2017 Cindy Boyle TO RECEIVE CPE CREDIT Participate in entire webinar Answer polls when they are provided If you are viewing this webinar in a group Complete group attendance form with Title & date of live webinar Your company name Your printed name, signature & email address All group attendance sheets must be submitted to training@bkd.com within 24 hours of live webinar Answer polls when they are provided If all eligibility requirements are met, each participant will be emailed their CPE certificates within 15 business days of live webinar 1
Jason Jobgen Director Alliance Services Cindy Boyle Partner IT Risk Services 2
AGENDA Common Terminology Types of Reports Recent Changes Questions? 3
COMMON TERMINOLOGY Service organization performs services outsourced by companies/auditee Service auditor CPA who examines & reports on controls at a service organization used in lieu or practitioner Users typically considered clients of service organization User auditor CPA who performs an audit on the users financial statements COMMON TERMINOLOGY SOC service organization control reports but AICPA moving to system & organization control reports Broader category of SOC suite of services SOC 2 + Will include additional attestations 4
WHAT ARE SERVICE ORGANIZATIONS? Service organization provider of services that may impact a risk to a user s financial reporting or that poses a business or compliance risk Services such as Cloud computing (SaaS, IaaS, PaaS) Managed security providers AR /AP/Payroll/Tax outsourcing Core financial IT system processing or hosting Customer support Health care claims management & processing TYPES OF REPORTS 5
PRIMARY TYPES OF REPORTS SOC 1 SOC 2 SOC 3 Controls affect user entities Financial statement ICFR Compliance & operations Compliance & operations Use of report Restricted Restricted General AICPA interpretive guidance & reporting vehicle SSAE No. 18 which includes AT-C section 320, AICPA Guide SSAE No. 18 which includes AT-C section 105 & AT-C section 205, AICPA Guide TSP section 100, AICPA, 2017 Trust Services Criteria SSAE No. 18 which includes AT-C section 105 & AT-C section 205,TSP section 100 AICPA, 2017 Trust Services Criteria Information obtained from AICPA.org PRIMARY TYPES OF REPORTS Contents of the report SOC 1 SOC 2 SOC 3 Description of service organization s system Management s written assertion Service auditor s report Type 2 includes a description of tests of controls & results of the tests Description of service organization s system Management s written assertion Service auditor s report Type 2 includes a description of tests of controls & results of the tests Service auditor s opinion on whether the entity maintained effective controls over its system Information obtained from AICPA.org 6
SOC 2 REPORTING Trust Services Principles (TSP) criteria Security (common criteria): system is protected against unauthorized access, use or modification Availability: system is available for operation & use as committed or agreed Processing Integrity: system processing is complete, valid, accurate, timely & authorized SOC 2 REPORTING Trust Services Principles (TSP) criteria Confidentiality: information designated as confidential is protected as committed or agreed Privacy: system s collection, use, retention, disclosure & disposal of personal information in conformity with the commitments in the entity s privacy notice & with criteria set forth in generally accepted privacy principles issued by AICPA & Canadian Institute of Chartered Accountants 7
SOC 3 REPORTING Public report Very abbreviated report essentially a SOC 2 light Assertion & opinion only on Suitability of design Operating effectiveness of controls Not on system description SOC 3 REPORTING No longer has a required seal There is a SOC logo that an organization can display from AICPA Essentially must do SOC 2 in order to issue a SOC 3 SOC 2 report must have an unqualified opinion Must cover at least a two-month period 8
SOC 3 REPORTING Currently cannot issue a SOC 3 unqualified opinion if There are carved out subservice organizations in the SOC 2 There are significant complementary user-entity controls necessary to achieve the applicable trust services principles criteria TWO SUB-TYPES OF SOC 1 & SOC 2 REPORTS 9
SUBTYPES OF REPORTS TYPE 1 Reports on fairness of presentation of management s description of the service organization s system Suitability of design of controls Point in time reporting May be useful when Organization is new Understanding system & controls is needed Recently made significant changes Insufficient time or history to perform Type 2 SUBTYPES OF REPORTS TYPE 2 Same as Type 1, plus Reports on fairness of presentation, suitability of design & operating effectiveness Includes a description of service auditor s tests of controls & results Covers a period of time 10
REPORTING TO MULTIPLE AUDIENCES Multiple reports scenarios SOC 1 & SOC 2 Services impacting ICFR of user & other services with TSP concerns SOC 2 & SOC 3 Services not impacting ICFR & need to use beyond current users such as marketing to prospects SOC 1 & SOC 3 Services impacting ICFR of user & other services with TSP concerns or marketing needs Note must be separate reports RECENT CHANGES SSAE 18 SOC for Cybersecurity Engagements 11
RECENT CHANGES SSAE 18 Subservice organizations Significant changes to service organization management responsibility Service auditor changes SUBSERVICE ORGANIZATIONS Introduces complimentary subservice organization controls (CSOC) Service organization must identify risks that subservice organization controls are not in place Service auditor must consider CSOC as part of risk assessment process & assess how management addressed the risks 12
SIGNIFICANT CHANGES TO SERVICE ORGANIZATION MANAGEMENT RESPONSIBILITY Previously, service auditor identified risks; now they are to obtain an understanding of how management identified risks Previously, service auditor was to determine which controls were necessary; now they are to understand which controls are necessary Emphasizes service organization management s responsibility for the narrative, objectives & controls SERVICE AUDITOR CHANGES Service auditor is now required to understand internal audit s role in the service organizations system Must obtain evidence of the accuracy & completeness of information like populations Service auditor must more clearly define intended users of the report 13
RECENT CHANGES SOC FOR CYBERSECURITY ENGAGEMENTS AICPA Guide June 1, 2017 Reporting on an Entity s Cybersecurity Risk Management Program & Controls In a cybersecurity risk management examination, the practitioner opines on: (a) management s description of the entity s cybersecurity risk management program & (b) effectiveness of controls within that program to achieve entity s cybersecurity objectives Examination results in issuance of a general use cybersecurity report designed to meet the needs of a variety of potential users UNDER DEVELOPMENT: SOC FOR VENDOR SUPPLY CHAINS An internal controls report on a vendor s manufacturing processes for customers of manufacturers & distributors to better understand the cybersecurity risk in their supply chains 14
PEER REVIEW SOC EXAMS ARE NOW REQUIRED SELECTIONS 15
BKD, LLP is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: www.nasbaregistry.org. The information contained in these slides is presented by professionals for your information only. Applying specific information to your situation requires careful consideration of facts & circumstances. Consult your BKD advisor before acting on any matters covered herein or in these seminars. CPE CREDIT CPE credit may be awarded upon verification of participant attendance For questions, concerns or comments regarding CPE credit, please email the BKD Learning & Development Department at training@bkd.com 16
THANK YOU FOR MORE INFORMATION // For a complete list of our offices & subsidiaries, visit bkd.com or contact: Cindy Boyle, CPA, CIA, CITP, CISA // Partner cboyle@bkd.com // 501.372.1040 17