SOC reporting
If your business handles data or processes for other companies, those customers may ask for proof that your controls work. A SOC report is the usual answer. Fairview Audit connects you with a partner firm that performs the examination.
Fairview does not issue reports or perform examinations.
What the work looks at
A SOC report is an independent report on the controls at a service organization. A CPA firm examines your controls and describes the result.
The main report types differ in what they cover.
- SOC 1: controls that may affect your customers' financial reporting. Payroll processors, loan servicers and benefit administrators are typical examples.
- SOC 2: controls related to criteria such as security, availability, confidentiality, processing integrity and privacy. It is aimed mainly at technology and cloud providers, and security is always in scope.
- SOC 3: a summary built from a SOC 2 examination, written for public distribution, with sensitive detail left out.
Reports also come in two forms. A Type 1 report covers whether controls are designed properly at one point in time. A Type 2 report also tests how they operated over a period. Both apply to SOC 1 and SOC 2. [VERIFY: current AICPA attestation standards and criteria for each report type]
Your own management writes the description of your system. The partner firm tests it and reports. A firm may also help you prepare before the formal examination. [CONFIRM: a partner firm supplies and approves whether readiness work is offered]
What you provide
Expect requests for the following.
- A description of your services, systems and the customers they affect
- Policies and procedures for security, access and change management
- Lists of key controls and who owns them
- Evidence that controls ran, such as logs, tickets and approvals
- Vendor lists, including subservice providers
- Prior SOC reports or audit findings
- Contact details for your IT, operations and compliance staff
Your customers or their auditors may tell you which report they want. Ask them before you request a firm.
What happens after you submit a request
- You submit a request on the path that fits your business.
- A partner firm contacts you to learn who is asking for the report and which services are in scope.
- You agree on the report type and the period covered.
- You share documents and give the firm access to evidence.
- The partner firm reports its findings to you. If it finds control gaps, it explains them before the report is final.
The engagement and any fees are between you and the partner firm under the firm's own terms.
Who it suits and how matching works
This service suits software providers, data centers, payroll and billing processors and other businesses that handle work on behalf of customers. It suits finance leads and operations managers who keep receiving security questionnaires and want one report to answer them.
Fairview offers three request paths: larger business, smaller business, or not sure or another need. There is no fixed size cut-off. Fairview matches each request by hand. Each path leads to its own form: larger business, smaller business or not sure. Your request goes to the matched partner firm, or to Fairview for manual matching on the not sure path. You then talk with the firm directly.
An independent partner firm that specializes in SOC reporting handles this work. Fairview Audit makes the match. We do not perform the review ourselves.Who does the work
Frequently asked questions
Which report do my customers want?
Ask them. Customers whose auditors rely on your processing usually want SOC 1. Customers focused on security and data handling usually want SOC 2.
What is the difference between Type 1 and Type 2?
Type 1 looks at design at a single date. Type 2 tests operation over a period. Type 2 gives higher assurance and is common in mature or regulated settings.
Is a SOC report a certification?
No. It is a report by an independent CPA firm on your controls. It does not certify your business.
Can we fix gaps before the examination?
Often yes. Tell the partner firm about known gaps at the start.
Related pages
- Services overview
- Internal audit outsourcing
- Financial statement audit and review
- SOC reporting for financial services
- Financial services industry
Tell us what you need reviewed. We match you by hand with an independent partner firm. You keep your existing vendors.Find out what you are overpaying.