From SOC 1®* Readiness to Your Final Report, Our Experienced Team is Here for You at Every Step.
Trust is the most important tool to grow your business, and a SOC 1® report can help differentiate your company from the competition, assuring clients that you have the necessary controls in place to protect the data that could impact their financial reporting.
The goal of a SOC 1® report is to provide an independent third-party opinion of the internal controls that may affect a user entity’s financial reporting. The report is designed to provide comfort to the organization’s users and the users’ assessors regarding the controls in place at the organization.
Completing your SOC 1® report and enforcing strong security procedures doesn’t have to be difficult. Auditwerx has provided more than 2,500 service organization control assessments since 2005. Put our industry expertise to work for your organization.
By proceeding, you are agreeing to the terms and conditions in the Auditwerx Privacy Policy.
Are you new to the SOC 1® reporting process? Security compliance and requirements might seem overwhelming, but not when you have the right partner to guide you through. Our experienced team, combined with our unique “hands on” preparation method, limits guesswork and helps you to quickly prepare for a successful SOC 1® assessment.
Every assessment we perform is completed with your end goals in mind. Our communication protocols provide for frequent contact with you throughout the engagement period in order to facilitate delivery on your expected timeline.
Communication is essential in completing a SOC report and it starts in the planning process. Our planning begins with a kickoff call. The kickoff call is used to make introductions, identify key players, and points of contact. We also begin the process of understanding the services on which we will be providing an opinion. Where a readiness assessment has been requested, we establish the dates for the readiness work (for first-time SOC reporters) and/or fieldwork (for recurring clients). In readiness, we assess the data flow of the services, identify controls, and provide a gap analysis of controls that may need implementation or improvement. The planning and readiness process is critical to creating open communication designed to obtain maximum efficiencies that will be realized in the Type 2 reporting process.
Our testing and assessment plans are shared with you as soon as they are customized for your processes. Customizing and sharing these plans allow us to provide a quality product in the shortest time possible. In addition, we provide templates and main points of the narrative process to help you get started with your description. We provide a draft of the assessment plan for your review and complete another call to go through the plan to assist you in assigning tasks for collecting supporting documentation and preparation for on-site testing. Once the assessment plan is finalized, we complete the details in preparation of and coordination with you for the on-site testing visit. Between the time of the audit plan approval and the on-site visit, your team starts compiling your supporting documentation and uploading it to our secure portal. Remember, we are there to help, so we invite open communication if you have any questions. This preparation is essential to an efficient and effective on-site audit experience.
OPTION 1: On-Site Fieldwork
We send our itinerary prior to our on-site visit and coordinate the on-site expectations. During the fieldwork, we conduct walk-throughs, controls testing, obtain testing documentation, and review other processes as necessary. We conduct an exit interview with you to provide initial testing results, go over next steps, and have a clear plan for completion of the testing portion of the SOC report. Our goal is to have 95% of all testing documents and your draft of the control description completed at the end of field work. This ensures your report is completed in a timely manner.
OPTION 2: Virtual Assessment
The virtual assessment process combines minimal hardware, collaborative software, and cameras to allow us to perform all or part of our assessment engagement virtually and in real time.
When testing and evidence gathering has been completed, your assessor composes a draft of your SOC report and submits it to our quality control team. Every draft SOC report is subjected to a manager and partner review based on our strict quality control process. Once your report has completed this round of reviews, it is provided to you for review, feedback, and modifications. After your draft is returned to us, a final quality control review is completed.
After the final report is issued, we will provide you with the appropriate seal of completion to be displayed on your website. This seal provides your prospective clients with notification that you have completed the SOC reporting process.
We have been working with Auditwerx for the last 3 years on our SOC* assessment. Their team has brought a level of knowledge and professionalism that has been unmatched…
There is a lot of information about SOC 1® floating around on the internet. New software tools are popping up every day claiming to save you time and money when it comes to your security compliance assessment. Our detailed FAQ will help breakdown the myths so that you can feel confident in your SOC 1® assessment.
The goal of a SOC 1® report is to provide an independent third-party opinion of the internal controls that may affect a user entity’s financial reporting. The report is designed to provide comfort to the organization’s users and the users’ assessors regarding the controls in place at the organization.
IT general controls typically included, but not limited to, if applicable, in a SOC 1®:
• Control Environment & Risk Assessment – controls around organization structure; policies and acknowledgements; employee background checks; management meetings/risk assessment
• Physical Access – controls around physical access (understanding if servers are onsite or if third-party data centers are used)
• Logical Access & Security – controls around logical access granted, modified, and removed, as well as privileged; passwords; websites; infrastructure (firewalls, SFTP, VPN, AV)
• System Monitoring – controls around monitoring software and subservice organization monitoring, if applicable
• System Change Management – controls around process for internally-developed software (authorization, testing, approval, segregation of duties, source code); patching; infrastructure changes
• Backup and Recovery – controls around the backup process (configurations, alerts, logs)
A “Type 1” report analyzes management’s description of a service organization’s system and the suitability of the design of controls related to the applicable trust services criteria description as of a specified date.
A “Type 2” report analyzes management’s description of a service organization’s system and the suitability of the design and operating effectiveness of the controls related to the applicable trust services criteria throughout a specified period. This type of report offers assurance to your clients on how your systems are used day-to-day. It usually offers a greater level of trust to your clients because they have more visibility into the way your systems are set up.
SOC assessments must be performed by a SOC assessor like Auditwerx. Even if other automated software tools claim to save you time or money, that may not necessarily be true if they cannot finalize your report. As the firm that would have to sign off on the report, we would still need to complete the reporting process with you to ensure that all appropriate requirements are met. This could require additional time, money, and headaches that could have been avoided in the first place.
A SOC 1® Readiness Assessment is your best preparation for a SOC 1® assessment. Our experienced team works to quickly complete your gap assessment in a timely manner, based on your organization’s unique needs. This will identify any gaps in your compliance controls or processes and allow you to remediate them before they impact your final report.
When it comes to compliance certification, service organizations can often find it difficult to balance customer requirements and ROI.
Our goal is to deliver the efficient compliance assessments you need, at a price that makes sense for your business. Once we have discussed your needs and current environment, there are several factors that impact our cost estimate:
Auditwerx is proud to offer a number of SOC 1® compliance solutions to meet your needs and business goals:
Our handy guide, “Adding it Up: What Type of SOC Report Do I Need?” is a great starting point to determine what kind of SOC report best fits your company’s business and compliance needs.
When you’re ready to speak with an experienced team about your reporting needs, Auditwerx will be here for you.
By proceeding, you are agreeing to the terms and conditions in the Auditwerx Privacy Policy.
Are clients or potential customers starting to ask for your latest information security compliance report? If you haven’t heard from them yet, expect those inquiries soon. ISO 27001 and SOC 2®* are two leading frameworks that can elevate your organization’s information security compliance initiatives.
If your organization is undergoing a SOC* assessment and using an automation tool, it’s essential to be aware of the heightened scrutiny you might face. Learn more.
Auditwerx, a division of Carr, Riggs, and Ingram, LLC, proudly announces its strategic partnership with Drata, the most advanced security and compliance automation platform.
