System and Organisation Controls (SOC)

More and more, companies are relying on third parties to increase efficiency, reduce costs and improve performance. However, working with third-party organizations carries a range of risks that did not exist in the past. Regulatory authorities in industries like the financial industry have made it clear that contractors cannot be blamed for their mistakes and companies must take a diligent and systematic approach to assessing and managing any risks associated with third parties.

Increased reliance on external service providers has also increased concerns about exposure to business risk. Shareholders, control committees, senior management, investors and regulators require organizations to assess and manage business risks. Therefore, organizations face risks that are difficult to identify, manage and control. Even if a service is outsourced, the risk will remain in the organization.

This has led organizations to require external service providers to submit System and Organization Controls (SOC) reports or service audit reports. Third Party Assurance (TPA) reports help service providers build trust in their service delivery processes and controls through certification by an independent public auditor.

How can we help you?

Our international team of specialists has extensive experience in the field and can ensure that risks are mitigated and meet their objectives.

Mazars is hired as an independent auditor by users or service provider entities. TPA commitments are made by the service auditor to provide an independent report on the vendor's internal control environment. This report is targeted at managers of the service provider organization (subcontractor), users (customers, potential customers) and/or their auditors, thus reducing the need for customers to perform their own audits.

Our methodology provides high quality in the resolution of the SOC 1, SOC 2 and SOC 3 assessment at a very competitive cost. We will provide you with guidance and support on the different options that are available to deliver a report that provides confidence and transparency about your control environment.

Controls in Service Organizations (SOC 1, SOC 2 and SOC 3)

SOC 1

Report on controls around the user's financial information in a service organization. Our clients must have confidence in any processes that affect financial statements. This report seeks to demonstrate the productivity and effectiveness of internal financial reporting controls.

SOC 2

Reporting controls around security, availability, processing integrity, confidentiality, or privacy in a service organization. Feeling confident about the information control environment is an invaluable asset that you can offer to your customers.

SOC 3

Report that provides customers with reliability on the SOC 2 report. Normally, SOC 3 reports can be freely shared and published on the internet. This report shows a little of the auditor's opinion, as well as language that provides context about the organization and the relevant IT infrastructure. This does not mean that no audit testing is required, but that it is done to provide certainty about the control environments described in SOC 2. This report does not contain much detail about the controls, which is why it can be shared without concerns.

Which SOC report does my organization need?

What to do to be prepared?

Determine the type of report and the standard to be applied.

Review the current description of the systems and controls to be validated, if appropriate. If necessary, strengthen internal control and risk management.