What is a SOC 3 Report?

One of the most common questions we hear field is, what is a SOC 3 report and do we need one?

What is a SOC 3 report?

SOC for Service Organizations: Trust Services Criteria for General Use Report - Trust Services Report for Service Organizations (SOC 3) are general use reports that can be posted on a company's website, they provide assurance to user entities about controls relevant to security, availability, processing integrity, confidentiality, or privacy and are intended for users that don't have the need for information included in a SOC 2 report.

What is not included in a SOC 3 Report?

SOC 3 reports do not include management's descriptions of the system or descriptions of the service auditor's tests of controls and test results.

When are SOC 3 reports appropriate?

SOC 3 reports are appropriate when you determine prospective customers don't require a SOC2 Type 2 report in order to make an informed decision about using your services. However, since SOC3 reports omit key information, your prospective customers will eventually want the assurance of a SOC2 Type 2 report. Therefore, always engage your auditor to perform a SOC2 Type 2 first, prior to determining if a SOC3 is appropriate.

How are SOC 3 reports performed?

SOC 3 reports include management's assertion stating controls were effective over a period of time, the system boundaries, and the service commitments and system requirements, and auditor's opinion about whether the assertion is fairly stated. SOC 3 reports are performed with the same procedures as a SOC 2 Type 2 audit.

SOC Resources

About SOC 3 Examinations

SOC 3 examinations are designed to meet the needs of users that desire assurance about the controls at a service organization that cover the same five categories as the SOC 2, but do not have the need for or the knowledge necessary to make effective use of the details contained in a SOC 2 report. Because they are general use reports, SOC 3 reports can be freely distributed or posted on a website.

How Can Schneider Downs Help?

Schneider Downs employs a unique approach to SOC reports, integrating the expertise of information technology, internal audit and external audit professionals. By combining cross-disciplinary knowledge and project management expertise, we are able to effectively deliver on our clients' expectations. If you are interested in learning how we can assist your organization, please contact us to get started or learn more about our practice at www.schneiderdowns.com/soc

You’ve heard our thoughts… We’d like to hear yours

The Schneider Downs Our Thoughts On blog exists to create a dialogue on issues that are important to organizations and individuals. While we enjoy sharing our ideas and insights, we’re especially interested in what you may have to say. If you have a question or a comment about this article – or any article from the Our Thoughts On blog – we hope you’ll share it with us. After all, a dialogue is an exchange of ideas, and we’d like to hear from you. Email us at [email protected].

Material discussed is meant for informational purposes only, and it is not to be construed as investment, tax, or legal advice. Please note that individual situations can vary. Therefore, this information should be relied upon when coordinated with individual professional advice.

© 2023 Schneider Downs. All rights-reserved. All content on this site is property of Schneider Downs unless otherwise noted and should not be used without written permission.

our thoughts on
Norton Believes Credential Stuffing Attack Led to LifeLock Breach
Why Cybersecurity Programs are Facing Increased Scrutiny from Private Equity Firms
Start The New Year Off Secure: 5 Cybersecurity Resolutions for 2023
TikTok: Spreading Holiday Cheer and Personal Information
Cybersecurity BY David Murphy
Key Benefits of Server Message Block Signing
SEC and PCAOB Developments Conference Day 1
Register to receive our weekly newsletter with our most recent columns and insights.
Have a question? Ask us!

We’d love to hear from you. Drop us a note, and we’ll respond to you as quickly as possible.

Ask us
contact us

This site uses cookies to ensure that we give you the best user experience. Cookies assist in navigation, analyzing traffic and in our marketing efforts as described in our Privacy Policy.