When deciding what kind of SOC report your service organization needs or what kind of report to request from your service organization, the options can be a little confusing. Especially when considering whether you need a SOC 2 vs a SOC 3 report. Many of our clients ask us what a SOC 3 report is, […]
About Megan Kovash (Partner, CPA)
Megan Kovash works primarily on SOC audits with experience in financial audit and internal audit as well. Megan started her career in January 2012 after completing her Masters of Accountancy with the University of Denver. She worked in the Risk Assurance group at Ernst & Young, then moved to the Internal Audit Data Analytics group at Charles Schwab. She is now a Partner at Linford & Co., LLP. Megan enjoys working with clients and coworkers to find and implement solutions to better her client’s business.
Risk Evaluation & Mitigation Strategies for SOC 2 Compliance
Risk evaluation and mitigation strategies for SOC 2 compliance is something I am being asked more frequently about by many first-time clients. In the following paragraphs, I will be discussing requirements for service organizations to consider when contemplating or undergoing a SOC 2 audit. Specifically, risk assessment and mitigation strategies in place at the service […]
What Are Bridge (aka Gap) Letters & How Do They Relate to SOC Reports?
Every year as summer draws to a close, one of the most sought-after topics for discussion that clients, business associates, and others reach out to our firm about is regarding Gap Letters— sometimes called Bridge Letters.
SOC Review Guidance: Tips for Reading SOC 1 & SOC 2 Reports
Many U.S. companies receive what, until recently, were called SAS 70 audit reports from certain types of vendors.
Inherent Risk vs Control Risk: Audit Risk for SOC 2 Reports
What is inherent risk and control risk and how do they relate to a SOC 2 audit? Inherent risk occurs due to the nature of the service provided and operation of the Company without consideration of any controls in place. Control risk is present as a result of the internal controls in place at the […]
A SOC 2 Compliance Checklist Doesn’t Exist, But Guidance Does
Has one or more of your customers requested that you undergo a SOC 2 audit? If so, you may be asking yourself, what is a SOC 2 report and how do I become SOC 2 compliant? Is there a SOC 2 compliance checklist I can use to prepare? The answers are not as straightforward as […]
How Bad is a Qualified Audit Report? Understanding SOC Report Opinions
How bad is a qualified report? This question comes up almost every time a qualified report is issued to a service organization.
Reasonable Assurance: What is It & How Does It Affect SOC Report Opinions?
In this blog, we will be discussing the concept of reasonable assurance, what reasonable assurance means, absolute assurance, and how they both relate to SOC report opinions. Understanding the meaning of reasonable assurance is useful to both management of the service organization and also the users of the SOC report. In relation to SOC reports, […]
SOC 2 vs. HIPAA: What’s the Difference Between a SOC 2 Report & a HIPAA Report?
Linford & Company offers two types of reports that address security, the SOC 2 Security report and the AT 601 HIPAA Security report.
How to Choose a VPN When Working from Home: Data Safety Considerations for Coronavirus
Due to current world events, many employees are now working remotely from home and the question of if a VPN is needed when working at home is at the forefront of many employers’ minds. In this blog, we will discuss what a VPN is, its benefits, if you need one, and how to select a […]