Perspectives
Four Tips for Successfully Managing to SOC 1 Audit Standards
With the increasing need for greater disclosure and transparency over the years, the Statement on Auditing Standards number 70 (SAS 70) has evolved into today’s Service Organization Control Report also known as “SOC 1”. Organizations voluntarily subject themselves to an independent auditor’s examination of their workflows, controls, and oversight, that not only protects the organization, but also provides confidence and assurance to our clients who utilize our services. Below are a few tips so that you may also have a successful independent auditor’s examination within your organization.
Understand your procedures and workflows that support those processes.
- This is critical to ensure that your control objectives and assertions are current. Without a good operational understanding as to why an enhancement may have occurred, an assertion may not be accurate and / or may require updating. Depending on the size of your organization this may be an impossible task for one individual to know all the procedures and workflows. You may need to rely on business leaders to provide you with any procedures or workflow changes that have occurred throughout the year.
Implement an internal audit program.
- An internal audit program will provide your organization with risk mitigation and the framework for testing your organization on an ongoing basis, similar to the due diligence that will be performed by your independent auditing firm.
A successful audit is all in the planning.
- As soon as you close out a successful audit, begin the planning for the coming year. Hold a meeting with your key stakeholders documenting the positives, what the challenges are that lie ahead, and what needs to be corrected for the next audit to run smoothly.
Leverage technology that centralizes, controls, and establishes simplified digital access to evidence of control and oversight over SOC 1 objectives and assertions.
- Providing the independent auditors with testing samples can involve multiple people and levels, depending on the size of the organization and the services offered. Large data requests can be labor and time intensive to assemble. At STP Investment Services, we utilize a robust and flexible proprietary software known as ControlOps. Our ControlOps technology can store our SOC 1 objectives and assertions along with the evidence of review and any necessary supporting documentation that may be required for easy retrieval at a later date.
