Controls at a Service Organization refer to the controls that are in place at your company.
Many of these controls should be covered within your policies and procedures, as they should reflect an accurate depiction of the various processes that occur within your organization. Accurate policies and procedures (P&P) should be designed, implemented, and documented by the service organization. When the service auditor is testing the effectiveness of your control objectives and activities, your P&P support the achievement of the control objectives. While P&P are not enough to determine that a process is operating effectively, they can support the design effectiveness of a control.
Typically a service auditor will perform testing, beyond P&P, around the control objectives and activities to support the fact that employees are performing their duties in accordance with the P&P, because without the additional testing, it would be impossible have comfort that they are actually being followed.
Simply put, good policies and procedures will only get you so far during an audit because you still need to prove to the auditors that the functions management say are being performed are being carried out correctly.
This information is also consistent with SSAE-18 which is effective as of May 1, 2017.
A SSAE 18 / SOC 1Type I Report shows Company’s that your Organization has appropriate controls designed and in place as of the date the report is issued. It does not provide assurance that controls are executed consistently, which, is the purpose of the Type 2 report and what most Company’s are hoping to see when asking for evidence of a SOC report.
So, while, the Type II is preferred, the Type I report is an important step in the right direction for an Organization who has never undergone an audit and looking to show they are serious about compliance.
A Type I Report is specifically defined by the SSAE 18 guidance as a “report on a description of a service organization’s system and the suitability of the design of controls”, essentially, a determination of if your company’s controls designed appropriately. When performing a Type I report, the auditors will test the design effectiveness of your Company’s controls by examining a sample of 1 item per control, review of policy, or through inquiry. This provides a user organization with some comfort that your company (the service organization) has controls in place (but not evidence of operating effectiveness). This can be useful when trying to obtain a contract to show good faith to potential user organizations or to maintain current contracts when Customers may have updated compliance requirements they must meet.
The SSAE 18 Type I report has 3 sections which include Management’s Assertion, the Auditor’s Opinion, and the System Description of the service offerings under review and corresponding control objectives and activities.
Some organizations have heard of SAS 70, SSAE 16, and now SSAE 18, but, haven’t seen the value, other than because one of their customer require it. Truth is, that’s a large part of the value, as many companies will not even think about outsourcing functions to a Company who does not have a clean SOC 1 or SOC 2 Type II Report in place, especially since Vendor Management reviews are now required.
Some benefits of having a SOC report in place include:
Ability to perform outsourcing services for Public Companies.
If performing financially significant duties for a Public Company, they are required to use a a provider with a valid SSAE 18/SOC 1 in place to give investors assurance over controls that are performed by the outsourcing Company.
Public and Private companies are more likely to trust your organization with their data.
Beyond any compliance requirements, if you were to trust a company with your data, you would want assurance it will be handled with the utmost care.
A year round accessible knowledge source (your auditors).
As a service organization, large or small, you will always have questions regarding your business and having a set of auditors in place with access to a wide array of business knowledge, it will allow you to bounce questions and concerns off of a group of trusted individuals who know your business.
A third party to review your controls and activities to ensure they are functioning appropriately, and give advice on how to improve upon them.
Sometimes your internal audit department is good, but, not always as stringent as they should be. This will help to serve as a check on their work, as well as your staff. Additionally, if there were any findings noted, your auditors are in a great position to give you some tricks and tips to improve and help ensure everything functions well the following period.
Improving performance of the organization.
Just the knowledge that a review is being performed of an employee’s work that can have far reaching consequences for the company as a whole. No more, “Oh, I didn’t realize that reviewing user access was THAT important to do this month, sorry”, now, everyone knows that if it’s not done, the success or failure of the organization could rest upon them.
Think of the SSAE-18 audit as an annual investment into your company, increasing potential new clients, productivity and accountability.
SSAE 16 is an enhancement to the current standard for Reporting on Controls at a Service Organization, the SAS70. The changes made to the standard will bring your company, and the rest of the companies in the US, up to date with new international service organization reporting standards, the ISAE 3402. The adjustments made from SAS 70 to SSAE 16 will help you and your counterparts in the US compete on an international level; allowing companies around the world to give you their business with complete confidence.
SSAE16 is now effective as of June 15, 2011, and if you have not made the necessary adjustments required, now is the time to find a quality provider to discuss the proper steps. All organizations are now required to issue their Service Auditor Reports under the SSAE 16 standards in an SOC 1 Report.
The soon to be effective, SSAE-18, is expected to follow a similar reporting structure to the SSAE-16 within a SOC 1 report.
If your Company (the ‘Service Organization’) performs outsourced services that affect the financial statements of another Company (the ‘User Organization’), you will more than likely be asked to provide an SSAE16 Type II Report, especially if the User Organization is publicly traded. Some example industries include:
Before starting the SSAE 16 process, there are a number of considerations one must take into account that can save considerable time, effort, and money in the long run. Use the following items as a mini checklist for yourself:
Does my Company need an SSAE16, or, are we doing it just because someone asked?
Reports on the low end can run at least $15,000 a year, will the business lost be less of a burden than the cost of the report itself?
Does your company have defined Business Process and IT controls in place, or, will you need assistance developing and implementing them (readiness assessment)?
Have you determined the controls in place which affect the outsourced services being provided?
Have key stakeholders been defined and included in discussions?
There are many other issues to consider before engaging a CPA firm to help with your SSAE 16, for a more detailed ‘checklist’ – please see The SSAE 16 Checklist
You may have heard SSAE-18 is on the horizon for reports issued as of May 1, 2017. There are some important updates discussed in here: SSAE-18 – An Update to SSAE-16.
As the standard is formalized and the date approaches we will continue to provide more information to help you prepare for these changes.