What Should a Service Organization Consider When Determining Its SOC Report Testing Period?

The American Institute of Certified Public Accountants does not mandate a minimum testing and reporting period for System and Organization Controls (SOC) reports. Instead, it suggests a reporting period of at least six months. Reports covering less than six months may not provide meaningful results to end users. 

Whether for SOC 1 or SOC 2, a Type 1 report covers procedures and controls at a certain point in time. Type 2 reports cover the existence and performance of procedures and internal controls over time. 

If the organization is commissioning a SOC report for the first time, an auditor may agree to a shorter reporting period. A short reporting period might also be appropriate when an organization has made changes to its system or scope of the SOC examination (e.g., included additional applications or services covered by the examination) or has made other key changes that would impact the SOC report. Once the changes have been implemented and sufficient time has passed to allow controls to operate, the SOC reporting period should revert to at least a six-month period. 

Management of a service organization is often asked to issue a bridge letter when a SOC report only covers a portion of the calendar or fiscal year of its customers. Since management issues the bridge letter, there’s no auditor assurance. However, it does provide management’s representation regarding changes made to the organization’s controls or confirmation regarding the lack of changes from the SOC report’s date to the effective date of the bridge letter. 

Schneider Downs employs a unique approach to SOC reports, integrating the expertise of information technology, internal audit, and external audit professionals. By combining cross-disciplinary knowledge and project management expertise, we are able to effectively deliver on our clients’ expectations. If you are interested in learning how we can assist your organization, please contact us to get started or learn more about our practice at www.schneiderdowns.com/soc

You’ve heard our thoughts… We’d like to hear yours

The Schneider Downs Our Thoughts On blog exists to create a dialogue on issues that are important to organizations and individuals. While we enjoy sharing our ideas and insights, we’re especially interested in what you may have to say. If you have a question or a comment about this article – or any article from the Our Thoughts On blog – we hope you’ll share it with us. After all, a dialogue is an exchange of ideas, and we’d like to hear from you. Email us at [email protected].

Material discussed is meant for informational purposes only, and it is not to be construed as investment, tax, or legal advice. Please note that individual situations can vary. Therefore, this information should be relied upon when coordinated with individual professional advice.

© 2024 Schneider Downs. All rights-reserved. All content on this site is property of Schneider Downs unless otherwise noted and should not be used without written permission.

our thoughts on
SOC 2 - What is ACTUALLY required?
The New IIA Global Internal Audit Standards - What You Need to Know Now
What are the OCC’s Key Areas of Focus for Fiscal Year 2024?
20 Pre-Contract Questions To Ask Your Next SOC 2 Audit Firm
Deutsche Bank Fined $186 Million For Insufficient Anti-Money Laundering Controls
ESG and Internal Audit: Board and Audit Committee Considerations
Register to receive our weekly newsletter with our most recent columns and insights.
Have a question? Ask us!

We’d love to hear from you. Drop us a note, and we’ll respond to you as quickly as possible.

Ask us
contact us

This site uses cookies to ensure that we give you the best user experience. Cookies assist in navigation, analyzing traffic and in our marketing efforts as described in our Privacy Policy.