Build trust through greater transparency and stronger controls.
As businesses increasingly rely on outside organizations to manage critical systems, data, and operational processes, customers and stakeholders want greater assurance that their information is protected and services are being delivered reliably.
A System and Organization Controls (SOC) report provides independent assurance regarding the controls your organization has established. It can help demonstrate your commitment to security, strengthen customer relationships, satisfy vendor risk management requirements, and reduce the time your team spends responding to individual audit requests and security questionnaires.
Which SOC Report Is Right for Your Organization?
Squire helps organizations determine which SOC report is appropriate, prepare for the process, and complete an independent examination with practical guidance from an experienced audit team.
SOC 1® Report
SOC 1 reports address controls at a service organization that may be relevant to its customers’ internal control over financial reporting. SOC 1 reports are commonly requested from organizations such as: Payroll processors Third-party administrators Benefit plan service providers Financial transaction processors Data centers and hosting providers Software providers whose systems process financial information
SOC 2® Report
SOC 2 reports evaluate controls relevant to one or more of the AICPA Trust Services Criteria: Security Availability Processing integrity Confidentiality Privacy Security is included in every SOC 2 report, while the remaining criteria may be included based on your services, customer commitments, and risk environment. SOC 2 reports are frequently requested as part of customer due diligence, vendor risk management, contracting, and procurement processes.
SOC 3® Reports
SOC 3 reports the same Trust Services Criteria used in a SOC 2 report but is designed for general distribution. It contains less detailed information about the organization’s systems, controls, and testing and may be shared publicly. A SOC 3 report is often issued alongside a SOC 2 Type 2 report and can support marketing, sales, and customer communication efforts.
SOC for Cybersecurity
SOC for Cybersecurity evaluates an organization’s enterprise-wide cybersecurity risk management program and the effectiveness of the controls within that program. Unlike a SOC 2 report, which focuses on the systems used to deliver services to customers, SOC for Cybersecurity can provide boards, senior leadership, investors, and other stakeholders with assurance regarding the organization’s broader cybersecurity risk management program.
Our Approach to SOC Reporting
Every organization’s systems, services, and customer requirements are different. Our process is designed to help you understand what is expected, evaluate your existing controls, prepare for the examination, and complete your SOC report as efficiently as possible.
Determine the Right SOC Report
We learn about your organization and needs to determine the appropriate SOC report type, scope, criteria, and reporting period.
Evaluate Readiness
We identify potential gaps in controls, documentation, policies, and processes to help prepare for a more efficient examination.
Perform the Examination
We evaluate the design and effectiveness of your controls while keeping the process clear and minimizing disruption.
Deliver Your SOC Report
We issue your SOC report, explain the results, and provide guidance to support future reporting and control improvements.
Why Business Trust Squire
Experienced SOC Professionals
Squire’s SOC team combines audit, accounting, internal control, cybersecurity, and information systems experience to help organizations navigate both the technical and operational aspects of the examination.
A Practical, Collaborative Process
SOC reporting can involve multiple teams, systems, policies, and control owners. We provide clear expectations, practical guidance, and consistent communication throughout the process.
Readiness Through Ongoing Reporting
Whether you are pursuing your first SOC report or completing an annual examination, we help you establish a reporting process that can be maintained as your organization, technology, and customer requirements evolve.
More Than 50 Years of Trusted Experience
For more than 50 years, Squire has helped organizations navigate complex audit, accounting, technology, and business requirements with technical expertise and a commitment to long-term relationships.
Frequently Asked Questions
What is a SOC report?
A SOC report is an independent report issued by a CPA firm regarding controls within an organization. Depending on the type of report, it may address controls relevant to financial reporting, security, availability, processing integrity, confidentiality, privacy, or an enterprise-wide cybersecurity risk management program.
Why might my organization need a SOC report?
Organizations often pursue SOC reporting because it is requested by customers, auditors, regulators, business partners, or procurement teams. A SOC report can also help support sales efforts, satisfy vendor risk management requirements, demonstrate a commitment to effective controls, and reduce repeated customer questionnaires or individual audit requests.
What is the difference between a SOC 1 and SOC 2 report?
A SOC 1 report focuses on controls that may affect customers’ financial reporting. A SOC 2 report focuses on controls relevant to security and, when applicable, availability, processing integrity, confidentiality, and privacy. The appropriate report depends on the services your organization provides and the information your customers and stakeholders need.
How long does the SOC reporting process take?
The timeline depends on the report type, scope, readiness of your controls, availability of documentation, and whether you are completing a Type 1 or Type 2. A Type 2 report also requires an examination period during which controls operate and are tested. Beginning with a readiness assessment can help identify potential issues before the formal examination begins.
Who can perform a SOC examination?
SOC examinations are performed by independent licensed CPA firms in accordance with applicable AICPA attestation standards. The AICPA maintains separate guidance for SOC 1, SOC 2, SOC 3, SOC for Cybersecurity, and other SOC services.
Ready to Demonstrate Your Commitment to Security?
Whether a customer has requested a SOC report, you are preparing for a new contract, or you want to provide stakeholders with greater assurance over your controls, Squire can help you determine the right path forward.
About Squire
Squire is an audit, tax, and business advisory firm with offices and teams across the Mountain West. With 50+ years of experience, we provide outsourced CFO and controller support, bookkeeping, payroll, sales tax, transaction support, ERP implementation and technology integration—helping businesses operate efficiently, stay compliant and achieve their financial goals. For more information, visit www.squire.com.