SOC 2 for IT service organizations

What is SOC 2?

More and more companies use IT service organizations for their automated data processing, ranging from a web application to the complete outsourcing of automation. For these IT service organizations it is of added value, for the trust of their customers, to be able to provide an independent assessment of the security, confidentiality, availability, processing integrity and/ or privacy.

IT service organizations can use the internationally recognized Service Organization Control standard (SOC 2) for this purpose.

SOC 2 offers an IT service organization a uniform opportunity to give customers and their auditors insight into the control measures and processes that apply to the service. In a SOC 2 audit an independent audit organization assesses the management objectives and measures of the service organization. A formal assurence report includes an auditor's statement. This gives existing and potential customers insight in the quality of the IT services.

The SOC 2 assurance report differs from other, traditional certifications because the SOC 2 assurance report is more extensive and is carried out annually by an audit. SOC 2 distinguishes two types of reports. 

Read more about SOC 2 Type 1 and Type 2 here.

Our SOC 2 audit support

2-Control has specialists  who can help you in the short term with an SOC 2 declaration. We have years of experience with SOC 2 processess at IT service organizations. Our organization consists of an enthusiastic team of registered IT auditors who will guide you to an assurance report form start to finish.

The advantages of SOC 2 

• The quality of the processes outsourced to you is guaranteed to your customers.
• You will receive confirmation from an external party that your organization is well managed.
• The account of a user organization can rely on this report for the audit of the financial statements.
• It is no longer necessary for clients to send auditors to you.
• Your organization is 'in control' and you communicate this to (potential) customers.

SOC 2 approach of 2-Control

Our aim is to achieve an assurance statement on security (mandatory), confidentiality, availability, processing integrity and/or privacy as set out in the SOC 2 guidelines issued by the AICPA Assurance Services Executive Committee (ASEC).

In order to mee this objective, we go through the following phases with you:

1. Baseline measurement:
   a. Alignment of scope;
   b. Alignment of standards.
   
   
2. Assessment of description and set-up of management measures (SOC 2 type 1)
   a. Verifying accurate picture of the description of the system;
   b. Determining the set-up of control measures through interviews, studying documentation and measures, observation, testing and sampling;
   c. Comparing reality with standards;
   d. Quality assessment and reporting on description and set-up (SOC 2 type 1 report).
   
   
3. Assessment of the effective functioning of management measures (SOC 2 type 2)
   a. Periodic determination of the operation of control measures by means of interviews, observation, testing and sampling;
   b. Comparing reality with standards;
   c. Quality assessment and reporting (SOC 2 type 2 report).

Differences SOC 2 and ISO 27001

• ISO 27001 is a security standard, this standard contains guidelines for information security of an organization. SOC 2 is an audit standard about outsourced IT processes. For this reason, ISO 27001 has limited added value for an accountant.
• ISO 27001 also does not have an assessment framework, as SOC 2 knows it.
• An ISO audit ultimately leads to a certificate and SOC 2 to an assurance report.
• An SOC 2 assurance report gives the customer insight into the organization, resources and processes that guarantee the quality of the automated data processing at the IT service organization. Based on an ISO certificate this insight is lacking.

Differences SOC 2 and ISAE 3402

• ISAE 3402 is mainly used to provide an opinion on processes that have an impact on financial reporting. This includes outsourcing administration, credit management, asset management, real estate management, payroll & HR services and pension administration. SOC 2 is used by IT service organizations to give customers confidence about security, availability, processing integrity, confidentiality and/or privacy.
• For readers of an SOC 2 assurance report it is immediately clear on the basis of which criteria this trust is given, because the auditor must use the so-called prescribed Trust Service Criteria as the assessment framework. Readers of an ISAE 3402 assurance report can only determine on the basis of the details of the report on the basis of which criteria trust is given. The assessment criteria for ISAE 3402 are free of form.

In the end, however, the question of the client (the user organization) is often decisive for which report is chosen. What does the client ask and what does the client want certainty about and for what purpose? An assurance report is never an obligation, but can lead to more effective cooperation and more trust between supplier and customer.