Auditing - SSAEs and SOC Reporting

by Jack Barkstrom - Attorney, CPA

The Audit Report - The Attest Function

The auditing field has traditionally been centered, or focused on, the attest function. The words attest or attestation, are terms for verify or verification, meaning to ascertain the truth, authenticity, or correctness of something, by examination, research, or testing. In reality, attestation happens all the time. Does a product live up to the seller's claims? It fell apart a week after I bought it, or it lasted longer than expected. In accounting, the attest function normally refers to the verification of financial statements and data - do the financial statements presented accurately represent the financial position of a company? There are variations of the term. Attest can either mean the process of verifying a statement or the formal statement issued by an auditor after reviewing the statements. The "attest function" refers to the activity of a certified public accountant (CPA) and the performance of audit procedures involved in the examination, testing, and verification of client accounting data prior to issuing an audit opinion. An "attestation (attest) engagement" is an assurance service provided by CPAs relative to more specific questions or limited areas of interest, such as system security, internal control, or compliance with laws and regulations. Audit reports and attestation engagements fall under a broader category known as "assurance services," which are independent professional services intended to reassure a client about whether a service meets the client goals for its operation, and provides advice for ways to improve its operation, if it falls short of expectations.(1)

Audit Firms and Accounting Services

One of the more commonly heard statements about CPAs during January, February, March, and April is "It's tax season - you must be really busy." For many established accounting firms, that is true, although it should be kept in mind that tax preparation is technically not an audit function and the CPA license is a license to conduct audits and issue audit opinions on financial statements, not a license to prepare taxes. On the other hand, CPAs do have more of the background, education, experience, and focus than non-CPAs to prepare taxes. On the other other hand, CPAs can be divided into two classes - those who hate taxes and limit themselves to auditing, and those who live to do taxes - the fanatics. There are a few, like me, who sort of understand taxes, but won't deal with them unless they have to, and only get motivated to deal with them with a lot of effort.

From auditing to taxes to Cybersecurity

If taxes are a step removed from auditing, how did the auditing profession go still further, and leap into another field - Cybersecurity? In what seems like ancient history, between 1939 and 1972, the AICPA issued Statements on Auditing Procedures (SAPs) through its Committee on Auditing Procedure. By 1972, or even before that, it was felt that SAPs had become outdated, so the AICPA renamed, or replaced, the Committee on Auditing Procedure, with the Auditing Standards Executive Committee (AcSEC), which began issuing Statements on Auditing Standards (SASs). The AcSEC was later replaced by the current Auditing Standards Board (ASB). The Audit Standards Board, in addition to issuing Statements on Auditing Standards, also was responsible for promulgating Generally Accepted Auditing Standards (GAAS), broad rules and guidelines for conducting audits. The GAAS standards are the counterpart of accounting's Generally Accepted Accounting Principles (GAAP) which provide guidance in the preparation of financial statements.(2)

The Statements on Auditing Standards are auditing standards for companies which are not publicly traded. Publicly traded companies are those listed on the stock exchanges. Auditing standards for publicly traded companies are set by the Pubic Company Accounting Oversight Board (PCAOB), which was established by the Sarbanes-Oxley (SOX) or (SARBOX) Act of 2002. While the PCAOB is a private sector, nonprofit corporation, its members are appointed by the Securities and Exchange Commission (SEC). The SEC might be said to have "considerable influence" over decisions by the PCAOB, although it would be more accurate to say that it dictates policy and tightly controls PCAOB activities. As a practical matter, the only people appointed to the PCAOB are those with years of experience with SEC-regulated companies. (Only two can be certified public accountants (CPAs) and the remaining three cannot be CPAs, although they must be "financially-literate.") They are as likely to influence and participate in SEC oversight as the SEC is likely to "dictate" policy. Perhaps the most important (or intrusive) impact on auditing is Section 404 of the Sarbanes-Oxley Act, which focuses on management involvement in internal control over financial reporting. There are limits to external requirements or mandates which demand involvement or knowledge of any aspect of a business. Can you force a company treasurer to spend time looking at travel expenses every day to prove that they are knowledgable in that area? Section 404, however, can impose reporting requirements in different areas which make it difficult to ignore. The auditor must attest to management reports on internal controls, which can involve asking questions of managers about what they know about internal controls. While managers can answer yes or no, an auditor can follow up by asking for detailed explanations.(3)

The Sarbanes-Oxley Act came about because of two accounting and auditing scandals - WorldCom and Enron. In 2001 WorldCom had reported a $2.4 billion profit, when it had actually experienced a $662 million loss. Its internal audit department had found an unsupported entry for $500 million in computer acquisitions, which led to further investigations. In June 2002, the company was forced to announce that it had inflated assets by $3.8 billion, seemingly the largest accounting fraud in history, until the investigation was complete and the total amount had grown to $11 billion. About the same time, the Enron Corporation went into bankruptcy - at the end of 2001. At the beginning of 2001, it had been listed as No. 7 on the Fortune 500 list, with a market capitalization of $75 billion. In October 2001, Enron officials reported a $618 million quarterly loss, which was followed in November 2001 by another announcement, that Enron had falsely claimed almost $600 million in earnings dating back to 1997. The audited financial statements for four years had to be restated. This was followed shortly thereafter by Enron's bankruptcy in December 2001. At least one part of the deception was the use of "special-purpose vehicles/entities (SPVs/SPEs)" where large debts could be recorded (and hidden) without being reported on Enron's balance sheet. Enron's auditor, Arthur Andersen, was accused of failing to properly audit Enron's financial statements. It might have survived that failure, except that it was convicted of obstructing justice for shredding documents and deleting e-mails during the investigation. It surrendered its CPA license and ceased operations. The Supreme Court later overturned the conviction, but since Arthur Andersen had ceased operations it could not come back.(4)

In 1985 the United States' National Commission on Fraudulent Financial Reporting was established in reaction to the corporate accounting scandals of the early 1980s. It would issue a report in 1987, which became known as the Treadway Commission Report, named for its chairperson, James C. Treadway, a former commissioner of the Securities and Exchange Commission (SEC). The Commission members, representatives of the participating organizations, or "sponsors," came to be known as the Committee of Sponsoring Organizations (COSO). The full title, at the time of the 1987 report was the Committee of Sponsoring Organazations (COSO) of the Treadway Commission. The representatives came from a variety of organizations, including the American Institute of CPAs, American Accounting Association, Institute of Internal Auditors, Institute of Management Accountants, and the Financial Executives Institute. Its reports were primarily audit related reports, with a focus, generally, on the prevention of fraud in financial reports, as well as measures to strengthen internal control and systems, along with the importance of "ethical organizational policies."(5)

Looking back, it's hard to tell which accounting scandals of the early 1980s they were referring to. There was the Savings and Loan crisis, or failure, which started in 1980. Between 1980 and 1988, nearly 1,200 savings associations or "thrifts" failed. Taxpayers lost an estimated $130-$150 billion, which led to the 1989 bailout bill, and the creation of the Resolution Trust Corporation (RTC), a federal agency to merge or close savings and loan institutions becoming insolvent between 1989 and 1982. Enron and WorldCom were the early 2000s. There was the global financial crisis of 2008, which led to the legislative bailout which pumped money into the economy in hopes of preventing a market collapse. What followed was termed the most serious economic recession since the Great Depression. It had been triggered by the sale of collateralized mortgage obligations, shares or securities in future payments of mortgage interest. Another risky investment which guaranteed huge returns, but failed to disclose risks - there weren't any, until there were. The sales people didn't understand them, but were pressured to promote them. As I recall, I attended a seminar around 2003 where a sales representive of Merrill Lynch assured everyone that there were so many safeguards and regulations in place that stock investments were absolutely safe. Apparently not as safe as claimed. Merrill Lynch did not totally disappear after 2009, but it was bought out by the Bank of America when it was forced into bankruptcy. Regulators decided it would not be rescued. What the Treadway Commission considered an epidemic of fraudulent reporting of the early 1980s was the signicant increase in financial failures resulting from the 1981-82 recession. It was not that they were wrong, it was more that they were premature. Only in 1989, when the number of failures had grown considerably and the scale of losses was understood, did the political world take notice and take action with the Financial Institutions Reform Recovery and Enforcement Act (FIRREA).(6)

If the Treadway Commission thought the early 1980s were particularly bad, they might have reviewed earlier scandals. There was the South Sea Bubble of 1720, when the share prices of the South Sea Company collapsed. In France, the Crédit mobilier bank of Paris crashed in 1867. It had been founded in 1852 with the idea of using the savings of small investors to invest in shares of newly emerging enterprises. And what about the Teapot Dome Scandal of the 1920s, which had involved the illicit leasing of naval oil reserves by Secretary of the Interior Albert B. Fall, in return for bribes during the Warren Harding administration. More recently, there is the fraud scheme devised by Bernie Maddoff, or the banking failure of Silicon Valley Bank in 2023. Silicon Valley Bank was not a case of missed audit signals. Banking regulators, in fact, had found a number of problems and had warned the bank of areas needing correction. Their warnings were ignored.(7)

The AICPA has its hands full trying to keep up with the auditing field - developing standards and guidelines - given the history of undetected fraud, changing technologies, and the creativity of perpetrators. That may be one reason why it decided to move the guidance for service auditors from auditing standards to attestation standards. It's not that the auditing standards don't apply in the attestation area. Many auditing guidelines, such as having adequate technical training and proficiency, as well as adequate planning will carry over to attestation standards. If a computer system or program is being evaluated, the person involved must have experience with computers. At the same time, the environment and goals, or standards, used to measure project progress are different. In other words, the mindset required for auditing is different than that of attestation. It is not quite the difference between reality and the world of the imagination. Auditing may focus on the reality of hard numbers, financial history, and what can be quantified, but auditors also are aware of computers, in fact have their own computer departments with very experienced computer specialists. They encounter problems which are more complex than locating paper copies of receipts and mathing them with entries in the books. For example, why are sales at this company higher or lower than similar companies in the same industry? Were they more efficient, have a better sales force, make a mistake, or was there fraud involved? Even in traditional financial reporting, those committing fraud have been very creative in inventing new financial transactions or approaches designed to evade detection.

In contrast to financial auditors, service auditors must look for situations which have not been encountered - not quite the world of the imagination, but very close. They can measure stages of a project and quantify project goals, or try to, but the world of computer technology has introduced a new, even expanding, set of variables. There is the broad question - Is my system secure? - which can be broken down to a very large list of specific question areas. Is my equipment up to date? Have the latest patches been installed? How many computers do I have? Can I even trust my employees? Even if I'm fairly up-to-date on threats, what potential or undiscovered threats are out there? Are my internal controls adequate or what can I do to improve them? Service auditors base their calculations on what they know about vulnerabilities and deficiencies of different organizations and systems. Service auditors do deal in historical data, but within a historical timeframe limited almost to the current few months, weeks or days. They must adjust to different client requests and different industries - some inspired by the latest breach headlines, where project timelines are not determined by a carefully-planned work schedule, but by technological advances and the inventiveness of attackers.(8)

SOC Reports - from Service Organization Controls to System and Organization Controls

CPAs have largely cornered the market on tax preparation, although taxes are a step removed from auditing. There is even a separate AICPA Statements on Standards for Tax Services (SSTS) covering that. How did the auditing profession go still further, and leap into another new field - standard setting in the area of information systems and cybersecurity? Part of the answer is that current auditing practices require an understanding of computer systems and the development of procedures to monitor them as part of an audit. Part of the answer is that the reason computers are used is related to financial reporting. Computer systems and accounting reporting are totally different fields of expertise. Computer programming and computer forensics are specialized skills, with totally different demands than financial reporting. Even if accountants use computers to prepare financial reports, they normally will not need to work with, or understand, the underlying progamming or computer code involved. It is helpful, if not absolutely necessary, to take a broad approach and to understand the relationship between the two fields. Accountants and auditors are, for that reason, in a better position to understand the overall relationship between the two fields and, in addition, able to gain the experience to work with both. In addition, their experience is likely to involve reporting requirements in a number of different industries and fields. Computer experts may understand the general protection measures, such as anti-virus software and firewalls, which will be universally employed by any system, but the specific requirements of hospitals and clinics, which may require compliance with federal HIPAA regulations and the protection of patient data will be different from those of the credit card industry, which is more concerned about customer credit card information, theft, and fraudulent charges. When things go wrong, it usually requires a computer specialist to do the analysis, not an auditor.(9)

In 2017, the AICPA decided that it needed to change the terminology it used to govern reporting for service organizations, which were covered by the acronmym "SOC" and called generally SOC reports. The original SOC acronym stood for "Service Organization Controls." After May 1, 2017, the AICPA wanted the term changed to "System and Organization Controls." Officially, the reason was to allow internal control examinations for organization other than, or in addition to, "service organizations." (Unofficially, maybe the reason was that the term service organizations sounded more like charities or charitable organizations.) Service organizations, in the accounting world, are definitely not charitable organizations. Traditionally, service organizations have meant entities that provide processing services to other organizations, often referring to an organization which processes payroll transactions for a user entity. However, while payroll services are the most widely used example, the type of services offered has been growing and can include medical claims processors, loan servicing companies, data center companies, and Software-as-a-Service (SaaS) companies.(10)

The SOC report had its start in April 2010, when a new standard under the attestation category (rather than the auditing category), called the Statements on Standards for Attestation Engagements (SSAE 16) was announced. SSAE 16 defined three types of SOC reports which at the time stood for "Service Organization Controls." SOC 1 reports dealt with Internal controls for financial statements and reporting. SOC 2 reports were a more in-depth look at internal controls, as measured against the AICPA's five Trust Services Criteria (TSC) or Principles: Security, Availability, Processing Integrity, Privacy, and Confidentiality. SOC 3 reports are primarily a summary of SOC 2 findings, summarized for public release. Since SOC 2 reports may contain detailed findings, which may include specific reference to vulnerabilities, they are usually not for public release.(11)

SSAE 16 was replaced by SSAE 18 on May 1, 2017. (There is no SSAE 17 since the AICPA skipped over it.) SSAE 18 still kept the three SOC reports, but SOC now stood for System and Organization Controls, instead of Service Organization Controls. The change from Service Organization Controls to System and Organization controls generally came with an expansion of review requirements and powers. With the increasing frequency of data breaches, along with the accompanying news headlines and awareness of hacking methods, SSAE 18 placed a greater emphasis on risk assessment. If previous standards took risk into consideration, SSAE 18 required auditors to identify all possible vulnerabilities, and where internal control systems might fail or be vulnerable. The latest headlines provided plenty of clues about where to look and what to look for. SOC 1 reports still focused on the impact of controls on financial reporting, however there was greater scrutiny, with stronger auditing practices. Reviewers, or auditors, needed to substantiate their conclusions, offering a more detailed analysis, meaning a greater level of proof. The review covered, not just third-party vendors, but also subservice organizations. SOC 2 reports were intended to cover, not just financial reporting, but overall security, especially the cyber security area, of an organization.(12)

In addition to, or as part of, SOC 1 and SOC 2 reports, there is an additional division into Type I and II reports. The basic difference is the extent of the review. Type I reports may involve a quick review of internal controls, as of a particular date or point-in-time. The auditor may look at whether an organization has a plan, has set up a management structure, has budgeted for the plan, and has an employee training program in place. The auditor may even meet with the assigned staff. The organization may provide proof that they have anti-virus software in place and have had a pen (penetration) test done, where someone tries to break into a system, to look for vulnerabilities. The problem is that it is difficult to know, as of any particular date, whether the internal controls are actually working. Anti-virus software may not be up-to-date. Pen testing done on a particular date, even if complete, may not disclose problems after it is done. In addition, the company may not have followed through on its plan.

Type II reports involve a more extensive look at internal controls, usually for a minimum time period of six months, but ideally up to a year. In the cyber security area, this may involve continuous electronic monitoring of the entire system: How does its system respond to hacking attempts? What does it detect? In terms of a company's planning, does it follow through on staffing or employee training? Does it make adjustments to discovered vulnerabilities, or its original plans? As the boxer Mike Tyson observed: "Everybody has a plan, until somebody hits you in the mouth."(13)

If the five AICPA Trust Services Criteria seem familiar, it may be because three of the criteria were tenets of information security, forming the C-I-A triad, for Confidentiality, Integrity, and Availability, or the A-I-C triad, (so as not to be confused with the Central Intelligence Agency). What were added were Security and Privacy.(14)

The AICPA added a new clarification in September 2020, when it issued a new Statement on Standards for Attestation Engagements (SSAE-21), called "Direct Examination Engagements," which applied to reports issued after June 15, 2022. Pior to that, in cases where the client was required to provide a written assertion, the auditor could only perform an "assertion-based" engagement. SSAE-21, AT-C section 206 added a new term - "Direct Examination Engagements." In essence, if the client would not or could not assert that internal controls were sufficient, the auditor could proceed with the review, basing their report on the auditor's direct observation and testing. In one sense, for a client not to provide a written assertion, is suspicious. On the other hand, if they have no or little understanding of computer systems, they may not be able to make an assertion about that area. In addition, there may be other reasons why they may not be in a position to make an assertion. They may have just been hired or they may see something suspicious in their reports. They may even hire an auditor specifically because they suspect fraud, theft, or malicious activity on the part of an employee. The auditor may have to decide whether it would be better to turn down the engagement, if they feel the client cannot be trusted.(15)

It should be kept in mind that the Statements on Standards for Attestation Engagements (SSAE) are intended as standards guidance. The auditor must comply with the standards if they accept an engagement. However, they do not require a client to accept every offered service. Clients can essentially ask for a full review, a partial review, or a review of a limited area. They may want a review of just physical security. If facility access is restricted by a card key, a coded combination lock, or a security guard, does it work in every situation, or are there areas needing improvement?(16)

SysTrust and WebTrust Assurance Services

One of the earlier forms of information technology assurance services were SysTrust and WebTrust attestation services, jointly created by the AICPA and the Canadian Institute of Chartered Accountants (CICA). SysTrust is intended to provide assurances to businesses regarding the reliability and integrity of their information technology systems. This may involve interaction with inventory suppliers, outsourced human resources and payroll, or disruption of any crucial system. WebTrust is somewhat narrower, in that it focuses entirely on the Internet, although, in that context, it deals with issues involving e-commerce security, which can cover a very broad range of requirements. With the increasing number of threats and discovery of new vulnerabilities, there is quite a bit of overlap.(17)

In a SysTrust engagement, a CPA performs an examination to evaluate a system's reliability. A positive SysTrust report attests to a system's reliability and ability to operate without material error, flaw, or failure during a stated period of time in a specified environment. A SysTrust report cannot be issued unless an examination-level engagement, the highest form of engagement reporting, has been performed. Under attestation standards there are three levels of engagements: 1) Examinations; 2) Reviews; and 3) Agreed-upon procedures. In the consulting area, a CPA does not need to perform a complete set of tests. The client may, due to costs or concerns, want only a specific area, such as sales department operations, or employee remote access security issues, looked at. Reviews, in essence, simply state that nothing came to the attention of the CPA to contradict management assertions. Review reports are unrestricted in distribution. Agreed-upon procedures, in contrast, are restricted in distribution to the involved parties and provide a detailed report on what was agreed on and what was found. Since they are likely to identify specific vulnerabilities, they would provide a road-map for potential attackers.(18)

An examination-level engagement requires that the CPA must follow Trust Services Principles in conducting the examination. What are considered one of the principles, depends on when the principles were issued. At one time there were four required for a SysTrust examination: 1) Availability; 2) Security; 3) Integrity; and 4) Maintainability. The number was increased to five: 1) Security; 2) Availability; 3) Processing Integrity; 4) Online Privacy; and 4) Confidentiality. Since the principles represent broad statements of objectives, they are likely to change over time to deal with emerging issues and concerns.(19)

SysTrust engagements typically divide systems into five elements: 1) Infrastructure, such as hardware and facilities; 2) Software, including operating systems, utilities, and business applications software; 3) People who operate and use the system; 4) Procedures, which can include information system backup and maintenance or input procedures; and 5) Data, or the information that the system uses and supports.(20)

The CPA, at the conclusion of the SysTrust engagement, provides the client with a reporting package which includes an attestation report, similar to an auditor's standard unqualified audit report for financial statements, a system description, and an assertion about the effectiveness of controls over the reliability of the system.(21)

The WebTrust Attestation for E-Commmerce

The WebTrust seal is designed to provide overall assurance about e-commerce activities, although it allows clients to select from a product menu of seven products, which are based on seven principles, the product best suited to their needs: 1) Privacy: Focuses on how the sources of private information are being collected, how that information will be used, distributed and corrected, when necessary, how cookies or other identification technologies are used, and how customers can opt out of transactions; 2) Transaction Integrity: Provides assurance that services or products are provided to customers as requested, information on the condition of goods, a timeframe for transactions, payment and delivery terms, and a means of canceling orders or receiving customer support and service; 3) Security: Attests to the existence of a functioning disaster recover plan, procedures to handle security breaches, the use of proper encryption technology, and the use of routine system backups; 4) Availability: Attests to the existence of access terms and conditions, availability policies that conform with legal, contractual, and other requirements, procedures that handle availability problems and security incidents, a functioning disaster recovery plan, and assurance that hardware and software have properly tested and documented availability objectives; 5) Nonrepudiation: Examines accessible records, procedures to authenticate authorized users, controls to record another party's assent to an online transaction, and safeguards against unauthorized users, as well as establishing which party is liable for loss at different stages of the transaction process; 6) Confidentiality: Offers assurance that the security surrounding transmission, collection, and distribution of confidential information is adequate, that proper procedures exist for confidentiality breaches, that choices are provided to customers, including the choice to opt out of certain terms, that there are safeguards on transmission to unintended recipients and against unauthorized access, and that the storage of backup media is secure; 7) Customized disclosures: An enterprise's specified disclosures must comply with applicable professional standards and be relevant to its e-commerce business, and effective controls must ensure that the disclosures are reliable. Possible disclosures include the number of visits to a website on a specific date and assertions about the size of the business or the website's popularity. Customized disclosures must be covered in a report issued in conjunction with at least one other principle.(22)

The WebTrust seal is a comprehensive e-commerce seal, intended to comply with a number of different standards, including the European Union data-protection and privacy standard, the United Kingdom Data Protection Act, the requirements of the Global Business Dialogue Exchange (GBDE), the Organization for Economic Co-operation and Development (OECD), and Privacy Bill C-6 in Canada. The AICPA has also signed agreements with the accountancy institutes of some individual countries.(23)

While the WebTrust seal is considered a "comprehensive" standard, it can be confusing to consider that there are actually more than one type of WebTrust seal. There are a number of subcategories, or even separate WebTrust designations, with their own WebTrust seal. The most common may be the WebTrust Program for Certification Authorities (CAs), which focuses on entities responsible for issuing and guaranteeing digital certificates, such as digital signatures or public key infrastructure (PKI) keys. There is also a WebTrust for Network Security, a WebTrust for BR-SSL, a WebTrust for Extended Validation, a WebTrust for BR - Code Signing, and a WebTrust for S/MIMI (Secure Multipurpose Internet Mail Extensions) and a number of others. In order to obtain a WebTrust seal, there are third-party entities which provide CA services, such as IdenTrust, Digicertk Sectigo/Comodo, GoDaddy, and GlobalSign.(24)

At a time when individuals are accustomed to ordering nearly everything online, the question is why would there even be the option of selecting different services. That has to do with the definition of e-commerce (electronic commerce). It does include retail sales of shoes or cooking ware, but it more broadly is defined as the carrying out of business transactions by computers. Consumers would definitely be interested in a number of assurances: privacy, transaction integrity, confidentiality, and security, although they may less interested in the existence of a backup recovery plan. Businesses, in contrast, which may the use of outside inventory suppliers or contracts with delivery services would be more interested in behind the scenes uses of e-commerce. They may use websites only available to select business partners, which may not be searchable by non-business consumers.

SOC for Cybersecurity

The SOC for Cybersecurity standard was introduced by the AICPA in 2017, intended to help organizations demonstrate a strong cybersecurity risk management program. In contrast to other SOC auditing standards, which are designed specifically foe service organizations, the SOC for Cybersecurity report is open to organizations across industries. While SOC reports, traditionally, have been related to, or focused on, "service organizations," the SOC for Cybersecurity offers a framework for businesses that typically wouldn't qualify as "service organizations". In other words, it is a stand-alone report for businesses other than service organizations.(25)

The SOC for Cybersecurity is guided by two criteria: 1) Description Criteria and 2) Control Criteria. The description criteria is management's description of the entity's cybersecurity risk management program, which is a narrative description written by the organization's management. (Whether management actually writes the report itself, or has the CPA write it for them, or uses a template written by the CPA is another matter, so long as they sign off on the final version.) The description will include three main components revolving around the risk question: 1) How the organization identies information assets - what methods it uses; 2) How the organization identifies and manages cybersecurity risks that threaten those information assets - what tools or analysis programs it uses; and 3) How the organization has implemented or will implement key cybersecurity control processes and policies intended to protect the organization's information assets against those risks.(26)

The Control criteria are the actual implementation measures undertaken by the cybersecurity risk managemet program, that is, the evaluated controls. Organizations are not required to follow any particular cybersecurity framework, but can choose among several, such as ISO 27001 or NIST CSF. CPAs will evaluate the controls using the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. Security involves the processes or methods used to protect information and systems from unauthorized access, disclosure, and damage. Among the implementation measures taken in the control area might be the assignment of staff to deal with security issues, along with budgeting allowances, the use of outside contractors on an ongoing basis, the installation and testing of the latest firewall software, an ongoing training program, and evidence that any available patches have been installed. Availability involves ensuring the accessibility of the system, products, or services, as stipulated by a contract or service agreement. Confidentiality involves protecting confidentiality as committed or agreed.(27)

Since the focus of the SOC for Cybersecurity assessment is on risk management, the Security, Availability and Confidentiality assessment would be based on hard evidence of the risk management program measures taken - rather than any statements by management. Analyzing risk, in its simplest form, might be evidenced by nothing more than a spreadsheet listing of computers, work stations, and physical locations, along with risks, such as fire, damage or theft, along with some calculation of risk based on the likelihood of occurence, and an assignment of estimated risk levels based on that calculation. It may involve the assignment of staff to keep the spreadsheet up-to-date. At a more sophisticated level, it may incorporate the use of risk software, or an outside service, to provide information on risk. The auditor may ask for a current report and may talk to any assigned staff and have them go over the process they use in preparing it, including how estimates were calculated. They may even have the staff member walk them around a facility to show that the staff member is familiar with the locations/assets included in the report. (Recalling one after-hours event, the speaker said when they started putting together a report, the data wasn't very useful in the beginning. However, over time the data collected was helpful because it provided evidence of patterns and a record of events for comparison.) It could be said that any assessment of controls relating to a risk management program is better done over a long period of time, if the evaluation is to provide an accurate assessment.

The final SOC for Cybersecurity report includes three sections/elements: 1) Management's description of the entity's cybersecurity risk management program; 2) Management's assertion; and 3) Practitioner's report. Management's description of the cybersecurity risk management program is a narrative describing the risk management program, written by the organization's management. It should be guided by the three description criteria, which includes 1) how the organization identifies information assets; 2) how it identifies and manages cybersecurity risks; and 3) the key cybersecurity control processes and policies. It could be said that, while the narrative is intended to describe the risk management program, it is probably not a good idea to write a ten-page description of the program. It is better to summarize the criteria. Identifying information assets might include a classification of assets, such as computers, facilities, or data, how it values them, such as listing their costs, where it keeps them, with their location, and how it removes and replaces them. Identifying and managing cybersecurity risks, as part of a risk management program, might include regular staff meetings to discuss risks, consulting with IT personnel or outside experts, such as security consultants or insurance industry contacts, or assigning staff whose duty is to keep lists of risks updated. Key cybersecurity control processes and policy implementation could involve indentifying and compiling list of key controls, having it regularly reviewed by management, and having an outside consultant review and update it.(28)

The management assertion (second) section is an assertion, or belief, also written by management, that the description contained in the first section, complies with the description criteria regarding asset identification, cybersecurity risk identification and management, and key control processes and policies implementation. It also includes an assertion that internal controls are effective in supporting cybersecurity objectives. This section does not need to be very long, since it is an assertion, in all likelihood, written, or signed, after a discussion with the CPA about what they have found.(29)

The pracitioner's report, the third section, contains the auditor's opinion on whether the Management's description, contained in the first section complies with the "description criteria" and whether the controls within the entity's cybersecurity risk management program are effective, based on the "control criteria," relating to the Trust Services Criteria for security, availability, and confidentiality. The practitioner's report section is a modified version of the standard auditor's opinion, essentially a summary of what was examined, the time frame of the examination, that the "examination was conducted in accordance with attestation standards," and a statement of the opinion expressed - "In our opinion."(30)

SOC for Supply Chain

The SOC for Supply Chain report, like the SOC for Cybersecurity report, is relatively new, but deals with another major, but important, commercial/business sector. There is some overlap, since the SOC for Supply Chain deals with cybersecurity threats. In fact, it was developed by the AICPA in response to a software development problem. In March 2020, it was discovered that the delivered version of a security monitoring software - SolarWinds Orion - was infected with malware. Supply chains may be impacted by cybersecurity attacks, but they are part of a broader range of services - all the activities and entities that are involved in moving a product from source to manufacturing to market. To get some idea of the complexity involved, Supply chain management (SCM) has five components: 1) planning; 2) sourcing; 3) manufacturing; 4) deliverty; and 5) returns. The SCM components can include suppliers, manufacturers, distributors, producers, customers, and business partners. From a broader perspective, the supply chain business components can be broken down into, or are dependent on, ultimately, a combination of other components. From that perspective, the supply chain consists of people, equipment, technology, organizations, activities, information, and transportation.(31)

Computers and advances in computer technology have made outsourcing to outside suppliers or external service providers possible. The same could be said of business processes or activities done internally. Activities which were once done by a single department, are now done by specialized divisions within a company, conducted at a distant facility, or outsourced to an external supplier. The idea of a service provider began with a focus on services, such as payroll or billing. Now service providers have taken over entire functions. In the area of inventory and parts ordering, a business may have an outside service track its level of inventory and decide when to re-order parts, and then use a different vendor to deliver the needed parts. It has introduced a new level of efficiency, but has created a new level of vulnerability and uncertainty. In the accounting field, there was a trend, (or fad), for the concept of Just-in-Time (JIT) inventory services. Essentially, you waited until you really needed parts to re-order, and then the supplier would deliver them - almost immediately. The idea was that you could eliminate the cost of a warehouse and inventory storage there. It was a great idea - until there was a strike, or the supplier ran short themselves, or winter storms or weather-related problems prevented deliveries. Maybe it might be a good idea to have some inventory available in a warehouse - just in case.

In the supply chain area, a company not only has to consider the risk of a cyberattack on its own operations, it must now consider the possibility of cyberattacks on its suppliers, its service providers, transporters, or any other service used. And cyberattacks are only one area of risk. What if your supplier goes out of business, or delivers bad or substandard parts - intentionally or unintentionally? What are the financial risks if the market for your product disappears? What about malicious complaints, bad reviews, or falsehoods spread over the Internet against you or one of your suppliers? How do you deal with damage to your reputation - known as reputational risks?

The SOC for Supply Chain report is similar to the SOC for Cybersecurity report in one respect. It still divides reporting into two criteria frameworks: 1) description criteria and 2) control criteria. While the description criteria are required to be included, the requirement is somewhat vague about what criteria must be included in the description. The description criteria (DC 300) requires a common language which the organization needs to develop to describe its supply chain risk management efforts. The description criteria needs to include, or address certain system issues: 1) Types of goods produced, manufactured, or distributed by the service organization; 2) Performance, production, manufacturing, and distribution commitments; 3) Incidents that impact the service organizatin's ability to meet its commitments; 4) Risks to achieve the service organization's commitments; 5) Information on the components, input, and boundaries of the system; 6) Controls to meet the applicable TSC (Trust Services Criteria); 7) Controls to be implemented by the users of the product; and 8) Any controls to be implemented by suppliers to the service organization. The description criteria leave it up to the organization to come up with the description language, but they do serve as a starting point by providing a preliminary list of risk areas to address.(32)

The control criteria section of the SOC for Supply Chain must include at least one of the five Trust Services Criteria categories, or some selected combination. It does not require all five. The five categories are: 1) Security - security practices which ensure that the system is protected against unauthorized access (both physical and logical); 2) Availability - availability practices which ensure that the system is available for operation and use, as committed or agreed; 3) processing integrity - processing integrity practices, which ensure that system processing is complete, accurate, timely, and authorized; 4) Online Privacy - online privacay practices, which ensure that personal information obtained as a result of e-commerce is collected, used, disclosed, and retained as committed or agreed; and 5) Confidentiality - confidentiality practices which ensure that information designated as confidential is protected as committed or agree.

Due to the cost of conducting a complete review, essentially a full audit, of any one of the Trust Services Criteria categories, clients may not want to pay for more than they feel they need. While it is assumed that they want the SOC for Supply Chain report to show other businesses or regulators they are up-to-date in dealing with risks, they may have other reasons they want a report. They may simply want an outside opinion from someone with experience to inform them of vulnerabilities and to keep them up-to-date.

The client should be aware that, if they choose not use all of the Trust Services Criteria, the auditor will modify their report section to reflect what services they provided and what their conclusions were.

In looking at the various reports covered by the AICPA's Statements on Standards for Attestation Engagements (SSAE), it should be kept in mind that they are not guarantees that a business will not suffer a malware attack, that suppliers will not go under, that employees will not steal, that market conditions will not change, or that a business will be successful. Insurance policies do not prevent accidents, they only limit the cost. SSAE reports are, at best, an educated guess about what will happen, based on available evidence. With that caveat, they nevertheless serve a useful purpose, if an entity chooses to study them. They are a useful tool, among all the tools available to businesses for planning.

• 1) Jae K. Shim, Joel G. Siegel, Nick Dauber and Anique A. Qureshi, Barron's Accounting Handbook, 360-361, Sixth Edition, (New York: Kaplan, Inc, d/b/a Barron's Educational Series, 2015); see also Alvin A. Arens, Randal J. Elder, and Mark S. Beasley, Auditing and Assurance Services An Integrated Approach, 8-10, 14th Edition, (Upper Saddle River, New Jersey: Pearson Education, Inc., 2012).
• 2) Shim, Barron's Accounting Handbook, 363, 527, 732; see also Arens, Auditing and Assurance Services, 31-37.
• 3) Shim, Barron's Accounting Handbook, 664, 704, 1019-1030; see also Arens, Auditing and Assurance Services, 4, 30-31, 40, 49.
• 4) Arens, Auditing and Assurance Services, 3, 209.
• 5) Shim, Barron's Accounting Handbook, 410, 765; see also David O'Regan, Auditor's Dictionary Terms, Concepts, Processes, and Regulations, 260, (Hoboken, New Jersey: John Wiley & Sons, 2004).
• 6) Karol K. Sparks and Harding de C. Williams, The Keys to Banking Law A Handbook for Lawyers, 35, 38 (Chicago, Illinois: American Bar Association, 2012); see also John Downes and Jordan Elliot Goodman, Dictionary of Finance and Investment Terms, 121, 585, Seventh Edition, (Hauppauge, New York: Barron's Educational Series, Inc., 2006); see also Thomas P. Fitch, Dictionary of Banking Terms, 88, 184-186, Sixth Edition, (Hauppauge, New York: Barron's Educational Series, Inc., 2012).
• 7) Arens, Auditing and Assurance Services, 28.
• 8) Arens, Auditing and Assurance Services, 801.
• 9) Shim, Barron's Accounting Handbook, 733.
• 10) Josie Hammond and Melissa Frivold, Auditing Employee Benefit Plans, 3-23, (Association of International Certified Professional Accountants, Inc., 2028); see also Rob Pierce, What is a SOC 1 Report? Expert Advice for Audit Compliance, Linford & Company, LLP website: https://linfordco.com/blog/what-is-soc-1-report, April 12, 2023, accessed July 19, 2025; see also Nicole Hemmer, SOC 1 vs. SOC 2 - How They Are Different & Which Report You Need, Linford & Company, LLP website: https://linfordco.com/blog/soc-1-vs-soc-2-audit-reports, April 5, 2023, accessed July 11, 2025; see also Hannah Grace Holladay, SSAE 16 vs SSAE 18: Changes to SOC Compliance Audits, KirkpatrickPrice website: https://kirkpatrickprice.com/blog/SSAE_16_vs_SSAE_18_Changes_to_SOC_1_Compliance_Audits, February 28th, 2024, accessed July 11, 2025.
• 11) Arens, Auditing and Assurance Services, 800; see also The History of SOC 2 , SecureFrame website: https://secureframe.com/hub/soc-2/history, accessed July 9, 2025;
• 12) Michelle Brown and Christian Burich SSAE 18: What You Need to Know , AuditBoard website: https://auditboard.com/blog/ssae-18, September 11, 2024, accessed July 8, 2025; see also Holladay, SSAE 16 vs SSAE 18: Changes to SOC Compliance Audits, KirkpatrickPrice website.
• 13) Rob Pierce, What is a SOC 1 Report? Expert Advice for Audit Compliance, Linford & Company, LLP website:; see also Nicole Hemmer, SOC 1 vs. SOC 2 - How They Are Different & Which Report You Need, Linford & Company, LLP website.
• 14) David Kim and Michael G. Solomon, Fundamentals of Information Systems Security, 10, 414, Second Edition, (Burlington, MA: Jones & Bartlett Learning, LLC, 2014).
• 15) Lois Colby, SSAE-21: New AICPA Guidance for Assertion-Based & Examination Engagements, Linford & Company, LLP website: https://linfordco.com/blog/ssae-21-new-attestation-guidance/, September 14, 2022, accessed July 8, 2025.
• 16) Nicole Hemmer, SOC 1 vs. SOC 2 - How They Are Different & Which Report You Need, Linford & Company, LLP website.
• 17) Arens, Auditing and Assurance Services, 10, 799-800; see also Anthony J. Pugliese and Ronald Halse, The CPA Journal, 1-2, CPA journal website: archives.cpajournal.com/2000/1100/features/f112800a.htm, accessed July 15, 2025.
• 18) Arens, Auditing and Assurance Services, 798; see also Pugliese, The CPA Journal, 2.
• 19) Arens, Auditing and Assurance Services, 799-800; see also Pugliese, The CPA Journal, 2.
• 20) Pugliese, The CPA Journal, 2.
• 21) Arens, Auditing and Assurance Services, 46, 798-799; see also Pugliese, The CPA Journal, 2.
• 22) Arens, Auditing and Assurance Services, 10, 799-800; see also Pugliese, The CPA Journal, 3; see also Schellman, Why Private Certification Authorities Need WebTrust Assessments, 2-6, Schellman website: https://www.schellman.com/blog/crypto-and-blockchain/why-private-certification-authorities-need-webtrust-assessments, July 27,2023, updated January 19, 2024, accessed July 15, 2025; see also CPA Canada (Chartered Professional Accountants Canada), WebTrust seal program, 1-4, CPA Canada website: https://www.cpacanada.ca/business-and-accounting-resources/audit-and-assurance/overview-of-webtrust-services, accessed July 15, 2025.
• 23) Pugliese, The CPA Journal, 3.
• 24) James Pengelly, The Official CompTIA Security+ Study Guide (Exam SYO-601), 126-127, (Downers Grove, IL: CompTIA, Inc., 2020); see also digicert, Webtrust Audits, 1-15, digicert website: https://www.digicert.com/webtrust-audits, accessed July 25, 2025.
• 25) Emily Bonnie, A Comprehensive Guide to the SOC for Cybersecurity Report, 2, Secureframe website: https://secureframe.com/blog/soc-for-cybersecurity, January 11, 2024 accessed June 30, 2025; see also RSI Security, Understanding AICPA Audits and Attestations: SSAE 16, SOC 1 vs. SOC 2, and Other Standards, 5-6, RSI Security website: https://blog.rsisecurity.com/understanding-aicpa-audits-and-attestations/, March 21, 2022, accessed June 30, 2025.
• 26) Bonnie, A Comprehensive Guide to the SOC for Cybersecurity Report, 4; see also RSI Security, Understanding AICPA Audits and Attestations: SSAE 16, SOC 1 vs. SOC 2, and Other Standards, 5-6.
• 27) Bonnie, A Comprehensive Guide to the SOC for Cybersecurity Report, 4; see also RSI Security, Understanding AICPA Audits and Attestations: SSAE 16, SOC 1 vs. SOC 2, and Other Standards, 5-6.
• 28) Bonnie, A Comprehensive Guide to the SOC for Cybersecurity Report, 4; see also RSI Security, Understanding AICPA Audits and Attestations: SSAE 16, SOC 1 vs. SOC 2, and Other Standards, 5-6.
• 29) Bonnie, A Comprehensive Guide to the SOC for Cybersecurity Report, 4; see also RSI Security, Understanding AICPA Audits and Attestations: SSAE 16, SOC 1 vs. SOC 2, and Other Standards, 5-6.
• 30) Bonnie, A Comprehensive Guide to the SOC for Cybersecurity Report, 4; see also RSI Security, Understanding AICPA Audits and Attestations: SSAE 16, SOC 1 vs. SOC 2, and Other Standards, 5-6; see also Arens, Auditing and Assurance Services, 798.
• 31) Joel Eshleman, A SOC for Supply Chain Report Can Help Reveal a Business's Vulnerabilities, 2, Clifton Larson Allen LLP website: https://www.claconnect.com/en/resources/articles/2022/a-soc-for-supply-chain-report-can-help-reveal-a-businesss-vulnerabilities, April 7, 2022, accessed August 11, 2025; see also Rhonda Willert, SOC for Supply Chain: Professional Guidance for Supply Chain Audits, 4, Linford & Company, LLP website: https://linfordco.com/blog/soc-for-supply-chain-auditing/, April 26, 2023, accessed August 11, 2025.
• 32) Eshleman, A SOC for Supply Chain Report Can Help Reveal a Business'e Vulnerabilities, 2-3, ; see also Willert, SOC for Supply Chain: Professional Guidance for Supply Chain Audits, 3.
• 33) Arens, Auditing and Assurance Services, 800; see also Willert, SOC for Supply Chain: Professional Guidance for Supply Chain Audits, 3; see also Eshleman, A SOC for Supply Chain Report Can Help Reveal a Business's Vulnerabilities, 3.