A SOC 2 Type II report assesses the design and operating effectiveness of an organization’s controls over a period of time. A SOC 2 Type II report is a report on an organization’s internal controls, capturing how a company safeguards customer data and how well those controls are operating.
Developed by the AICPA, a SOC 2 Type II report is an attestation of an organization’s overall security posture. The following Trust Service Principles are reported on: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is mandatory, however it is important to note that you only need to include the TSPs that are relevant to your organization’s business operations.
A SOC 2 report is common among SaaS solutions that process, transmit and store confidential information. Oftentimes organizations are finding that they need a SOC 2 Type II report to work with large customers, or certain customers that request a SOC 2 compliance report before entering into any business partnership.
During the audit period there is a lot of communication between key stakeholders throughout the organization. While at times things can become stressful and frustrating, it’s important to maintain those relationships and build trust. One relationship in particular that needs to be built is with the marketing department.
The marketing department will be instrumental in helping other businesses understand that the company has been audited by a third party and that an attestation report is now available. Using social media and spreading awareness regarding the company’s success and compliance efforts can also lead to bigger customers who could have overlooked the organization previously because they have stringent security controls in place.
Once the organization has successfully received its attestation report and the audit period has closed, the organization can then start using the AICPA SOC 2 logo in regards to its marketing material. Creating awareness is a big factor for your customers.
After the audit period has ended and the audit team issues a preliminary report, the organization’s management team will be given time to review it and provide what is known as a management’s response. It should be noted that management does not have to provide a response, however if there are deviations or if a control changed and the control was deemed not operating effectively, then this is the opportunity for a management rebuttal as to the reason why. Management’s response to the findings can be added in Section 5 of the SOC 2 report.
In all engagements for a SOC 2 attestation there is a shared responsibility model that is in place between you as a lead implementer, the service auditor, and the organization. That shared responsibility model encompasses trust between all three parties.
The lead implementer will be responsible for the gap analysis assessment, designing and implementing controls, and act as a vital communication line back to the organization.
The service auditors’ duties will be to run point on the engagement from an audit perspective. They will ask for the samples, examine testing output against the controls, and ask for evidence.
The organizations’ responsibility will be to listen and ensure that deadlines are being met to achieve a desirable and favorable attestation report. The organization will need to work in tandem with the lead implementer to ensure the following; roles are known, timelines are set, and the evidence is collected in a timely fashion.
