FAQ: How much review does a low-risk vendor need?

A low-risk vendor may need only a brief documented assessment. First, check:

What systems and information it can access.
How sensitive that information is.
What happens if the service fails.
How easily you could replace it.

A supplier with no system access and little operational impact may need limited review. A low-cost service with administrator access may need much more.

Record why you chose that review depth. Revisit it if the service or access changes, and account for applicable contractual and regulatory obligations.

Read more: Which Vendors Need the Most Oversight?.

Additional FAQs

How many updates to SOC 1 have there been?

SSAE numbers identify attestation standards, not SOC 1 report versions. The major historical changes were SSAE 16 replacing SAS 70 for service-auditor reporting in 2011, followed by SSAE 18 in

How do we know when spreadsheets are no longer enough?

Look for repeated failures in coordination, not just team size. Warning signs include broken evidence links, unclear ownership, conflicting versions, missed reviews, and excessive time reconciling records. Measure where the

Can our SOC 2 auditor also help us prepare?

Some preparation assistance may be possible, but independence needs to be evaluated for the actual services and relationships. Ask the CPA firm to explain the permitted scope of help and

Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask: If names or reports cannot be shared, ask for alternative evidence and record

Are Representation Letters Required in SSAE 18?

Yes. For SOC 1 examinations, the applicable AT-C requirements call for management’s written representations. This was not entirely new with SSAE 18: SSAE 16, codified in former AT section 801,

What is covered in the Availability criteria?

The Availability criteria address whether information and systems are available for use as needed to meet the service commitments and system requirements in scope. Practical work includes capacity planning, monitoring,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide