Audit Checklist for Soc 2 or Soc 3 Audit Sherry Jones, Reciprocity

If your company is a service organization and your customers trust you with their data, you may need to pass a SOC 2 (System and Organization Controls 2) audit. Compliance and certification are the goals of a SOC 2 audit. Because the integrity, confidentiality, and privacy of your customers’ data are on the line, they’ll want you to prove that you have the internal controls in place to protect that data. The SOC 2 compliance audit gives them that assurance.

SOC 2 Audit Checklist

This SOC 2 audit checklist will help you prepare for your next SOC 2 audit.

Develop a SOC 2 Audit Framework

The first thing you need to do is determine what you’re going to test for and why. You should establish a framework to meet your customers’ needs and guarantee them that you meet the necessary SOC 2 requirements. Be sure your framework allows your SOC 2 auditor(s) to accurately assess that you meet the requirements for SOC 2 compliance.

Define the Objectives of Your SOC 2 Audit

Determine what your clients want to learn from your SOC 2 audit. However, if they want to know something specific about your financial internal controls, you’ll likely need a SOC 1 audit. If your clients are worried about cybersecurity then you’ll have to prepare materials for a SOC cybersecurity audit.

Determine the Scope of Your SOC 2 Audit

SOC 2 is designed for service organizations, including software-as-a-service providers, that store customer data in the cloud. Before 2014, cloud storage providers only had to meet SOC 1 (previously known as Statement on Standards for Attestation Engagements no. 16 or SSAE 16) compliance requirements. The scope of your SOC 2 audit typically addresses infrastructure, software, data, risk management, procedures, and people. There are two types of SOC 2 audits: SOC 2 Type 1 and SOC 2 Type 2 (SOC 2 Type II). A service organization that undergoes a SOC 2 audit tells the auditor whether to perform a SOC 2 Type 1 or SOC 2 Type 2 audit. The type of SOC 2 report you need will depend on your specific objectives and requirements. A SOC 2 Type 1 report attests to the design and documentation of a service organization’s internal controls and procedures as of a certain date. However, the SOC 2 Type 1 report doesn’t include the actual operation of the controls. A SOC 2 Type 2 report also provides evidence as to how a company actually operated its controls over a certain period of time (usually between six months and a year). A SOC 2 Type 1 report is a fast, efficient method to assess the design of your controls. However, a SOC 2 Type 2 report can offer greater assurance by more rigorously examining your internal controls for a longer period of time.

Select the Trust Services Criteria/Principles to Include

The scope of your SOC 2 audit may revolve around infrastructure, software, procedures, people, or data while covering the trust services principles (security, availability, confidentiality processing integrity, and privacy). So you’ll have to determine which trust services criteria, also referred to as trust services principles, you want to test for. Any trust services criteria you include will increase the scope of your audit. Therefore, select the trust services criteria that are appropriate and applicable to the services you’re providing. During a SOC 2 audit, your auditor will review the internal controls your service organization has implemented that are relevant to the following five trust services principles as defined by the AICPA:

• Security: Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage that could compromise the availability, integrity, confidentiality, and privacy of that information or those systems.
• Availability: Information and systems are available for operation and use to meet your service organization’s objectives.
• Processing integrity: System processing is complete, valid, accurate, timely, and authorized to meet your service organization’s objectives.
• Confidentiality: Information designated as confidential is protected to meet your service organization’s objectives.
• Privacy: Personal information is collected, used, retained, disclosed, and disposed of properly to meet your service organization’s objectives.

These categories above all share a common set of standard criteria.

• Control environment
• Communication and information
• Risk assessment
• Monitoring activities
• Control activities – which are further broken out by:
  • Logical and physical access
  • System operational effectiveness
  • Change management
  • Risk mitigation

The only criteria the AICPA requires for SOC 2 audits is security. The other four are optional, so when you’re preparing for a SOC 2 audit, you can decide which criteria to apply and how. You should talk with your customers to identify which trust services criteria to test for in addition to security. Think about the trust services principles that pertain to your clients’ requirements. For example, if you store your customers’ data but don’t process it, availability might apply while processing integrity would not apply. But if you manage your clients’ transactions, it’s likely that processing integrity would be important.

Perform a Readiness Assessment

Preparing for a SOC 2 audit can be daunting, especially if it’s your first SOC 2 audit. Performing a readiness assessment, however, can enhance the effectiveness of your SOC 2 report because it enables you to find problems in your control framework. A readiness assessment can help you figure out how prepared you are for your SOC 2 audit. You can perform a readiness assessment on your own, or you can hire an auditing firm to perform your readiness assessment. Doing a readiness assessment offers you a chance to identify any issues before you perform your official SOC 2 audit.

Perform a SOC 2 Gap Analysis

Once you’ve completed your audit preparation, you should perform a gap analysis. This process, which typically takes about two months, will help you identify problems and/or risky areas in your cybersecurity practices. While you’re performing your SOC 2 gap analysis, you also have to select an audit firm to conduct your SOC 2. Then during the SOC 2 audit, your auditor will test your organization’s internal controls by conducting a number of activities, including an in-depth review of your policies and procedures and interviews with your employees. After completing the testing, your auditor will review key findings and record any exceptions. Then your auditor will issue the SOC 2 report. Reviewing this SOC 2 audit checklist before you start will help you prove that your clients’ data is secure. Developed by the American Institute of Certified Public Accountants (AICPA), SOC 2 defines criteria for managing customer data based on five “trust services principles”:

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

The AICPA created SOC 2 to establish an audit standard that addresses the ongoing trends of cloud computing and software as a service. Compliance with SOC 2 tests a service organization’s internal controls. These internal controls aim to help measure how well service organizations protect customers’ data and ensure clients that they can be trusted to keep their data secure. The purpose of a SOC audit is to achieve a SOC certification or SOC attestation. To achieve a SOC attestation, you have to be audited by an independent certified public accountant (or CPA firm) who determines if you have implemented the appropriate safeguards and procedures. A SOC 2 report is one of the SOC reports created by the AICPA. A SOC 2 report describes the internal controls that a company uses to process data. The SOC report also details the security and privacy of that data. The AICPA developed SOC 2 reports to meet the needs of end-users, including regulators and business partners as well as customers, that require detailed information and assurances about the internal controls deployed by their service organizations. SOC 2 reports can play a key role in:

• Organizational oversight
• Vendor management programs
• Risk management processes and internal corporate governance
• Regulatory oversight

If a customer demands an audit report or industry regulations require that you conduct one, you’ll likely have to provide proof of SOC 2 compliance to demonstrate that you’ve properly secured your clients’ data. Your service organization can benefit from a SOC 2 audit report in other ways. SOC 2 reports can uncover information that can help you operate more efficiently and securely. In addition, SOC 2 compliance can help your service organization bolster its financial statements, stability, and reputation by documenting, evaluating, and improving your internal controls.

This ebook is one of 13 that I wrote for my client Reciprocity, makers of ZenGRC software, using information I obtained in an interview with the company’s SOC 2 subject matter expert as well as my own research.

Client: Reciprocity

Format: ebook