Looking for a SOC Audit Report? How to Choose the Right One, Based on Your Needs.

SOC Audit Reports At A Glance

SOC reports help organizations demonstrate their commitment to internal controls, related to the design and effectiveness of specific financial reporting control objectives (SOC 1), or Trust Services Criteria (security at a minimum), designated by the AICPA to report on the suitability of the design and operating effectiveness of the defined controls (SOC 2).

How Do I Choose Which SOC Report is Right For Our Company?

The specific control objectives, or trust services criteria, vary based on the type of SOC report required by the organization for use by its end-user customers.​  There are three categories of SOC reports, although the first two types are the most commonly requested.

SOC 1 (Financial Reporting Focused)

SOC 1 reports provide assurance on the specific internal controls in place at a service organization that are relevant to a user entity’s financial reporting processes (ICFR).  These focus on internal controls designed to mitigate risks related to the preparation of financial statements, for organization's whose system supports their end-user clients' financial reporting process.

SOC 2 (Security, Availability, Processing Integrity, Confidentiality, and Privacy Focused)

Evaluates controls that fall into categories defined by the AICPA, and can be grouped into five primary Trust Services Criteria: Security (minimum a for SOC 2), Availability, Processing Integrity, Confidentiality, and Privacy.  These reports provide assurance that the organization operates suitable internal controls to protect its clients' sensitive data, in addition to providing service availability, integrity of processed data, confidentiality, and data privacy, based on the needs of its end-user clients. 

SOC 3 (Public Summary of Controls Focused)

Provides a higher level summary of an organization’s internal controls, intended for a more general audience, beyond its key-user base, and may be provided for public distribution.  These reports are intended for a broader audience and provide a high-level overview of the service organization’s controls, without the detailed controls listing or testing results.