Category: Advisory

Home / Advisory
Jan42019

ISAE 3402 | SOC 1 Type I vs. Type II

Type I versus Type II

 

To clarify which SOC Types your organization needs, here’s the essential information.

There are two types of ISAE 3402 reports: a Type I report and a Type II report. Both reports are the same in content. The difference lies in the performed audit; in a Type I audit, the accountant determines whether the risk management framework and control measures cover the framework (design) and exist at a specific moment. To determine this, the accountant “walks through” processes. These controls are called walkthroughs. In a Type II audit, the accountant determines over a period of at least six months whether the control measures have actually been effective. A Type I report relates to one measurement point, and a Type II report relates to at least six months.

With a Type II report, a user organization has more certainty that the service is controlled as agreed. The period in which the ISAE Type II audit takes place is a minimum of six months unless there is a special situation, such as the purchase of a new organizational unit or the introduction of a new IT system.

The first audit always requires some extra work for the organization and auditor to build mutual understanding. Undergoing Type I to Type II spreads that business impact, as Type I requires fewer audit tests. For Type I, auditors test every sample of every control practice to confirm the transaction designs. For Type II, auditors select and test multiple samples from auditor populations. A Type I report paves the way for Type II without addressing everything at once.

One advantage of Type I reports is the flexibility during the audit, where “issues” can be identified before the report is released. These are not included as issues in the report because it is a snapshot at the time of recording.

ISAE 3402 advice?

ISAE 3402 reports are read not only by your customers but also by their accountants. A report that does not meet best practice or one that is less professionally described is likely to be recognized by your customer or your customer’s accountant as less professional. With Securance’s experience with ISAE 3402 since 2004, we are well-positioned to prepare a professional report. We can also provide you with appropriate advice on how to improve measures so that you have better control over the risks.

Learn more about Securance and ISAE 3402.

Aug172018

COSO Enterprise Risk Management

COSO Enterprise Risk Management

When an organization aims to achieve its objectives, it must address risks that threaten these objectives and manage them. COSO has defined various elements of an internal control system for this purpose. The COSO model depicts the direct relationship between:

  1. Organizational objectives;
  2. Control components;
  3. The activities/units requiring internal control.
  4. COSO identifies the relationships between enterprise risks and the internal control system. COSO operates under the notion that internal control is a process aimed at ensuring the achievement of objectives in the following categories:
  5. Achieving strategic objectives (Strategic);
  6. Effectiveness and efficiency of business processes (Operations);
  7. Reliability of financial reporting (Reporting);
  8. Compliance with relevant laws and regulations (Compliance).

Furthermore, organizations must demonstrate to investors and other stakeholders that they handle uncertainties correctly (Code Tabaksblat and the Sarbanes-Oxley Act). In the Risklane approach to Enterprise Risk Management (ERM), risks are identified, and their consequences are detailed. Risklane utilizes the latest standards, methods, and techniques in risk management for this purpose.

Aug122018

Steps to Successful Risk Management

Steps to Successful Risk Management

Risk management is a tool to systematically and explicitly identify, evaluate, and better manage risks by addressing them proactively. Risk management is based on conducting risk analyses.

In risk management, risks are controlled by determining how to manage the likelihood of the risk occurring or its consequences for identified risks.

The company identifies risks, understands as much as possible the financial implications of the risks, and implements measures accordingly. By considering the possible risks of certain policies at an early stage, these can be prevented or any serious consequences can be mitigated.

A one-time risk analysis is not sufficient. Only when the risk analysis is regularly repeated and updated, and the resulting measures…

STEP 1: IDENTIFYING RISKS

Risk identification encompasses all strategic, operational, financial, and traditional (damage) risks. The connection with the goals of the organization and business units is essential.

STEP 2: ANALYZING AND ASSESSING RISKS

Mapping out the risks allows for their analysis. A financial manager cannot stop at merely identifying risks. It is important to determine which risks are the greatest. Not all risks deserve the same attention; start with the most important ones.

STEP 3: ANALYSIS OF CURRENT CONTROL MEASURES

Companies can distinguish themselves from their competition by managing their risks more efficiently. In this phase, it must be determined whether the risks are not overly controlled and whether there are blind spots.

STEP 4: DESIGNING AND IMPLEMENTING ACTION PLANS

After the control measures have been mapped out, the financial manager must make a choice. What happens to the remaining risks? For each risk, they must choose from the following four options:

  • Avoid
  • Reduce
  • Transfer
  • Accept

STEP 5: MEASURING, MONITORING, AND REPORTING

Risk management is a continuous process. It is important to measure whether the action plans are affecting the risk profile. Risk information can also be used for planning audits.

STEP 6: INTEGRATING RESULTS INTO DECISION-MAKING PROCESSES

The risk information can be used for the analysis of future decisions (through risk analyses from the past). For each new investment proposal or major project, the organization must consciously take the risks into account.

Aug62018

What suits my organization better? SOC 1 or SOC 2?

What suits my organization better?

SOC 1 or SOC 2?

The SSAE18 standard (AICPA) from the United States includes two types of reports; a Service Organization Control Report 1 (SOC 1) and a Service Organization Control Report 2 (SOC 2). This terminology is increasingly being used internationally. An ISAE 3402 report is within this terminology a SOC 1 report, an ISAE 3000 report is a SOC 2 report.

An ISAE 3402 report is a report on how the service provider manages risks over the processes that are outsourced. Outsourcing, and more specifically financial processes, are the framework for this report. An alternative to this report is the SOC 2 report where outsourcing is not the primary framework, but rather information security. The criteria for information security and privacy are included in the Trust Service Criteria. Criteria related to security, privacy, availability, and confidentiality. Additionally, there is a SOC 3 report.

Do I need an SOC 1?

A Service Organization Control 1 is an audit of internal controls focused on securing client data. SOC 1 audits are conducted according to Statement on Standards for Attestation Engagements No. 16 (SSAE 16). A SOC 1 includes control objectives used for internal control over financial reporting. The financial statements are thus the framework for this report. This means that all processes are designed to ensure that all data in the financial statements is accurate and complete.

In other words; if you process or host data related to a financial process, then SOC 1 is applicable.

Do I need an SOC 2?

If you process or host data that do not affect your clients’ financial statements, then SOC 2 is applicable. In this case, your clients are mainly interested in whether you handle information security and privacy correctly.

In an SOC 2 report, similar to an SOC 1 report, internal control measures are included.

Which type of report is best for me now: SOC 1 or SOC 2?

An important difference is that privacy is not mandatory in an SOC 1 and in an SOC 2 based on the Trust Service Criteria, it is. If you have clients falling into both categories, there is a reasonable chance that you will be asked to provide both. You can determine whether you need an SOC 1 or SOC 2 report to fulfill the needs of a wide variety of clients. Risklane offers a unique Online Audit Tool (ControlReports) that supports you in integrating the SOC 1 and SOC 2 audits, resulting in two separate reports. At no extra cost.

If you want more information about the impact of SOC 1 (ISAE 3402), SOC 2 (ISAE3000) for your organization, please contact Securance (+31) 030 2800888.