Service Organizations

Anytime a company uses a third party to provide a service, the company wants assurances that the job will be completed timely, accurately, and securely. An SSAE 16, SOC 2, or SOC 3 audit is a great way to show your clients you are committed to completing the job successfully and with a great deal of quality.

SSAE 16, SOC 2, and SOC 3 audits of internal controls will demonstrate to your clients you have controls in place to ensure the job is completed with quality and efficiency. Our procedures will review the controls related to the organization of your company, the hiring practices, the physical/environmental controls, as well as other IT and finance-related areas.

The audit may focus on the processing of client transactions or the security of your client’s information. A service organization has several options for reporting the controls to its clients. An SSAE 16 audit is designed to ensure financial transactions are completed in a secure environment while SOC 2 and SOC 3 audits are designed to ensure a quality control environment is in place and your system is appropriately designed and operating effectively.

A system is comprised of the following components:

• Infrastructure – The physical and hardware components of a system (facilities, equipment, and networks)
• Software – The programs and operating software of a system (systems, applications, and utilities)
• People – The personnel involved in the operation and use of a system (developers, operators, users, and managers)
• Procedures – The automated and manual procedures involved in the operation of a system
• Data – The information used and supported by a system (transactions streams, files, databases, and tables)

There may be many attributes of the system that you provide to your clients. These can include some or all of the following:

• Security – The system is protected against unauthorized access (both physical and logical)
• Availability – The system is available for operation and use as committed or agreed
• Processing Integrity – System processing is complete, accurate, timely, and authorized
• Confidentiality – Information designated as confidential is protected as committed or agreed
• Privacy – Personal information is collected, used, retained, disclosed, and destroyed in conformity with applicable client needs, laws, and/or regulations.

We want to be your partner. For additional information please Contact Us