FAQ

Software, applications and databases utilized to process financial transactions of publicly traded companies, as well as the servers housing these systems are required to be Sarbanes-Oxley compliant. Thus, the accounting system (for example: SAP, Oracle, Dynamit, QuickBooks, etc.),

Service organizations often issue SSAE 18 SOC reports with reporting periods inconsistent with user entity financial reporting years, creating a “gap” in the internal controls. For example, a SSAE 18 SOC 2

SOC report coverage can vary in length. They typically cover 6 -12 months. The reports should be renewed each period to ensure continued control effectiveness. If you are reviewing a third party’s SOC report,

There are five trust service criteria: availability, security, privacy, confidentiality and availability.

There are five trust service criteria: availability, security, privacy, confidentiality and availability.

Type I –   A report on policies and procedures placed in operation as of a specified point in time. SSAE 18 type I reports evaluate the design effectiveness of a service provider’s controls and then confirms the controls have been placed in operation as of a specific date.

Type II – A report on

SOC 1 – Report on controls at the service organization relevant to the user entities’ internal control over financial reporting. i.e. If an organization was considering outsourcing payroll processing to AEP, they would want to obtain and inspect a

Financial Processes conducted on behalf of other are optimal for a SSAE SOC1 (Payroll processor, Investment Management Provider, Bill Collection/Payment).Cloud Software As A Service Solutions and Colocation Providers, such as Hiring and On-boarding Software Solution, Accounting & ERP Software in

SSAE 18 is guidance for performing and reporting on third party service provider examination, review, and agreed-upon procedures engagements (Service Organization Control Reviews (SOC)). SSAE 18 completely replaces SSAE 16. Some might also remember the old SAS 70.