Articles
-
SOC 1
What Happened to SAS 70? Understanding SOC 1 Reports Today
SAS 70 is no longer used, but many vendors still reference it. Learn what replaced SAS 70, how SOC 1 reports work, and what to review in a vendor report.
By Maggie CheneyMay 20, 2026 -
Compliance
Audit Risk & the Audit Risk Model (ARM): An Auditor's Complete Guide
Learn about audit risk, the audit risk model (ARM), and how to reduce risk in SOC 1/SOC 2 audits. An auditor's guide to acceptable risk levels & planning.
By Maggie CheneyNovember 12, 2025 -
SOC 2
SOC Audit Failure: Common Audit Mistakes to Avoid
Worried about SOC audit failure? Learn the most common SOC audit mistakes organizations make and practical strategies to prevent them in your compliance efforts.
By Maggie CheneyApril 2, 2025 -
Compliance
CrowdStrike Outage: Lessons Learned in Controls & Resiliency
Learn from the CrowdStrike outage to enhance your organization's IT resilience. Discover key lessons in third-party risk, incident response, & cybersecurity controls.
By Maggie CheneyAugust 7, 2024 -
Compliance
What is Data Classification? Levels, Compliance, & Standards to Follow
When it comes to compliance, data classification is critical. This includes understanding how data should be maintained & protected within your organization.
By Maggie CheneyAugust 30, 2023 -
Compliance
Audit Engagement Letters & Required Audit Terms: Tips for Preparation
What does your organization need to know about audit engagement, required audit terms, & executing an audit engagement letter? This guide will help you prepare.
By Maggie CheneyMarch 29, 2023 -
SOC 2
What is Operational Risk Management? Expert Guidance for Managing Risk
What is operational risk management (ORM)? Learn about the types of organizational risk, the benefits to your organization, and how it relates to SOC 2.
By Maggie CheneyNovember 16, 2022 -
CMMC & NIST
Understanding the NIST Privacy Framework: Insights from an Auditor
What is the NIST Privacy Framework and what do you need to know to create one for your organization? Here is guidance on mapping and more from an auditor.
By Maggie CheneyJune 8, 2022 -
Compliance
Information Security Governance: Guidance for IT Compliance Frameworks
What is Information Security Governance, and how does it benefit you? Here is guidance to create a unified IT compliance framework within your organization.
By Maggie CheneyFebruary 2, 2022 -
CMMC & NIST
What is the NIST Cybersecurity Framework & How Does SOC 2 Map to It?
Here is expert guidance on how to use the NIST CSF to implement a cybersecurity framework that maps to the SOC 2 Criteria and supports your audit compliance.
By Maggie CheneyJuly 14, 2021 -
SOC 1
Management Responsibility in an Audit - Who Does What in a SOC Audit?
What is management responsibility in an audit? Here's professional insight into the difference between management vs auditor responsibilities during SOC audits.
By Maggie CheneyJanuary 20, 2021 -
Compliance
Understanding the Limitations of Internal Controls - Learning to Mitigate Your Risk
What are "inherent limitations" of internal controls, and how could they affect your company? Advice on what to look for, and preventative measures to take.
By Maggie CheneyJune 3, 2020
Get in touch
Have a question an article didn't answer? Talk to a partner.
Get straightforward answers from experienced auditors.