to the security, availability and processing
integrity of the systems a service organization
uses to process user entities’ data, and the
confidentiality and privacy of the information
these systems process.
By engaging an independent CPA to examine
and report on a service organization’s controls,
service organizations can respond to meet the
needs of their user entities and obtain an
objective evaluation of the effectiveness of
controls that address operations and
compliance, as well as financial reporting at
those user entities. To provide the framework
for CPAs to examine controls and to help
management understand the related risks,
the AICPA has established three Service
Organization Control (SOC) reporting options
(SOC 1, SOC 2 and SOC 3 reports).