SOC reporting for financial services
Financial services firms sit on both sides of SOC reporting. They rely on reports from vendors that handle their data or process their transactions.
Many also provide reports to their own clients, such as custodians, administrators, lenders and payment processors. Fairview Audit connects you with a partner firm that can help with SOC work. Fairview does not perform it.
This page covers SOC reporting for Financial services businesses.
What SOC reports are
SOC stands for System and Organization Controls. A SOC report is an independent accountant's report on the controls at a service organization. A SOC 1 report concerns controls likely to affect a client's internal control over financial reporting. A SOC 2 report concerns controls relevant to security, availability, processing integrity, confidentiality or privacy.
Why this matters in financial services
If you outsource processing, hosting, payroll, collections or record keeping, your auditors and examiners may ask what you did to oversee the vendor. A SOC report is one common answer. Receiving the report is not enough. Someone has to read it, and act on what it says.
If you are the service organization, your clients may ask you for a report as part of their own oversight.
What a review typically looks at
Reports you receive
- Whether the report covers the service you actually use, and the period you rely on.
- Exceptions noted by the accountant, and whether they affect your processes.
- Complementary user entity controls, which are controls the report assumes you perform yourself. Many teams overlook these.
- Subservice providers the vendor relies on, and whether they are covered.
- Whether the report is Type 1 or Type 2. A Type 1 report describes controls at a point in time. A Type 2 report adds testing of how they operated, and older testing gives less support.
- Gaps between the end of the report period and today.
Reports you provide
- Whether the systems and services in scope match what clients ask about.
- Which type of report fits the client request.
- Whether controls are documented and tested well enough to support the report.
- Readiness work before an examination begins.
Tip: Keep a simple register of vendors that matter to your financial reporting. Note which have a report, the period it covers, and who reviewed it.
What to have ready
- A list of service providers that handle your data or transactions.
- The latest reports you hold from each.
- Your vendor oversight policy and review records.
- For providing a report: descriptions of your systems, services and existing controls.
- Client or examiner requests that asked for a report.
- Policies for access, change management and incident response.
- Contacts in finance, technology, risk and compliance.
Timing and scope
A report covers a defined period and a defined set of systems. Readers sometimes assume it covers more than it does. A partner firm can help you read the scope statement carefully, so you know which of your vendor's services the report actually supports.
How matching works
You choose a request path: larger business, smaller business or not sure. There is no fixed size cut-off. Fairview matches each request by hand. A matched partner firm contacts you, or Fairview matches you by hand. Fees and terms are between you and the firm. SOC examinations are performed by CPAs. [CONFIRM: which partner firms perform or support SOC reporting]
An independent partner firm that specializes in SOC reporting handles this work. Fairview Audit makes the match. We do not perform the review ourselves.Who does the work
Frequently asked questions
Does a partner firm both advise me and issue the report?
Ask the firm how it handles independence between advice and reporting. [CONFIRM: a partner firm supplies and approves this statement]
Is a SOC report a certification?
No. It is an accountant's report on controls described by the service organization.
Is this related to my vendor payments?
Only indirectly. Payment checks fall under accounts payable audit for financial services.
Tell us what you need reviewed. We match you by hand with an independent partner firm. You keep your existing vendors.Find out what you are overpaying.