The American Institute of Certified Public Accountants does not mandate a minimum testing and reporting period for System and Organization Controls (SOC) reports. Instead, it suggests a reporting period of at least six months. Reports covering less than six months may not provide meaningful results to end users.
Whether for SOC 1 or SOC 2, a Type 1 report covers procedures and controls at a certain point in time. Type 2 reports cover the existence and performance of procedures and internal controls over time.
If the organization is commissioning a SOC report for the first time, an auditor may agree to a shorter reporting period. A short reporting period might also be appropriate when an organization has made changes to its system or scope of the SOC examination (e.g., included additional applications or services covered by the examination) or has made other key changes that would impact the SOC report. Once the changes have been implemented and sufficient time has passed to allow controls to operate, the SOC reporting period should revert to at least a six-month period.
Management of a service organization is often asked to issue a bridge letter when a SOC report only covers a portion of the calendar or fiscal year of its customers. Since management issues the bridge letter, there’s no auditor assurance. However, it does provide management’s representation regarding changes made to the organization’s controls or confirmation regarding the lack of changes from the SOC report’s date to the effective date of the bridge letter.
Schneider Downs employs a unique approach to SOC reports, integrating the expertise of information technology, internal audit, and external audit professionals. By combining cross-disciplinary knowledge and project management expertise, we are able to effectively deliver on our clients’ expectations. If you are interested in learning how we can assist your organization, please contact us to get started or learn more about our practice at www.schneiderdowns.com/soc.
You’ve heard our thoughts… We’d like to hear yours
The Schneider Downs Our Thoughts On blog exists to create a dialogue on issues that are important to organizations and individuals. While we enjoy sharing our ideas and insights, we’re especially interested in what you may have to say. If you have a question or a comment about this article – or any article from the Our Thoughts On blog – we hope you’ll share it with us. After all, a dialogue is an exchange of ideas, and we’d like to hear from you. Email us at [email protected].
Material discussed is meant for informational purposes only, and it is not to be construed as investment, tax, or legal advice. Please note that individual situations can vary. Therefore, this information should be relied upon when coordinated with individual professional advice.