Our approach to SOC audits, summarized below, ensures an efficient, minimally invasive engagement with regular communication throughout the process. We guarantee each of our our clients will work with highly-skilled professionals whose knowledge spans multiple technical disciplines.
During joint discussions with management, we determine which people, processes, and technologies relate to the services provided to user organizations.
After we obtain the signed agreement, we prepare an initial request list and an illustrative Risk and Controls Matrix (RCM).
We then plan our interview schedule for the onsite fieldwork.
We arrive on-site, typically a Monday morning, and start conducting interviews based on the interview schedule.
We perform the interviews and conduct walkthroughs of the processes and controls. We obtain documentary evidence to support our audit procedures.
Many first year examinations include a readiness assessment wherein we conduct certain examination procedures and communicate to management any internal control weaknesses.
We write up the description of services and the testing performed.
We issue the SOC report.
We typically work backwards from when the client (i.e., service organization) would like the audit report in their hands to share with their user organizations. This almost always drives the timing of our work.
This is highly dependent on the scope of the examination and may result in two to five (or more) auditors being onsite for a period of one to several weeks. Typically, more time is spent in the first year of an examination than in subsequent years. Moreover, first year examinations may include two or more site visits. One site visit related to the readiness assessment, another being related to the actual examination.
Our audit methodology is divided into four distinct phases and includes proactive communication throughout the audit process, rather than delivering requests for corrections at the end of the reporting period. This proven methodology streamlines the audit process, resulting in minimal business interruption and full compliance with the audit guidance and related interpretations.
Plan The Audit
During Phase 1, we gain a clear understanding of the information technology environment, information systems, risks, controls, and management expectations.
Walkthrough and Evaluate the Design of Controls
During Phase 2, we complete the procedures that provide the basis for our opinion on the suitability of the design of key controls. During this phase, we will often draft the report and communicate it with management.
Test Operating Effectiveness of Controls
During Phase 3, we conduct tests of the operating effectiveness of key controls (in accordance with the procedures specified in the draft report) and gather sufficient audit evidence for our opinion.
Report the Results
During Phase 4, we hold discussions with management and appropriate shareholders to ensure stakeholders are aware of the examination results, and we deliver the final report along with a formal management communication.
"*" indicates required fields
