SOC 2 and 3 Audits are American Institute of Certified Public Accountants (AICPA) standards. The AICPA Assurance Services Executive Committee (ASEC) has developed a set of criteria (trust services criteria) to be used when evaluating the suitability of the design and operating effectiveness of controls relevant to the security, availability, or processing integrity of information and systems, or the confidentiality or privacy of the information processed by the systems at an entity, a division, or an operating unit of an entity.
As in any system of internal control, an entity faces risks that threaten its ability to meet the trust services criteria. Such risks arise because of factors such as the following:
- The nature of the entity's operations
- The environment in which it operates
- The types of information generated, used, or stored by the entity
- The types of commitments made to customers and other third parties
- Responsibilities entailed in operating and maintaining the entity's systems and processes
- The technologies, connection types, and delivery channels used by the entity
Trust Service Criteria
- Security- Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity's ability to meet its objectives.
- Availability- Information and systems are available for operation and use to meet the entity's objectives. Availability refers to the accessibility of information used by the entity's systems, as well as the products or services provided to its customers.
- Confidentiality- Information designated as confidential is protected to meet the entity's objectives. Confidentiality addresses the entity's ability to protect information designated as confidential from its collection or creation through its final disposition and removal from the entity's control in accordance with management's objectives.
- Privacy- Personal information is collected, used, retained, disclosed, and disposed to meet the entity's objectives. Although the confidentiality applies to various types of sensitive information, privacy applies only to personal information.
Applied Areas
SOC Audits are beneficial to all companies in the service industries, which includes, but are not limited to:
- Banking/ Financial Service Providers
- ACH Processors
- Insurance Companies
- Technology Service Providers (TSPs)
- Application Service Providers (ASPs)
- Cloud Hosting Service Providers
- Software-as-a-Service (SaaS)
- Payroll Providers
- Managed Service Providers
- Health Care Claims Processors
- Collection Companies
- Third-Party Administrators
- Data Centers