Improving the use of SOC 1 Reports

SOC 1 Services

In a SOC 1 engagement, the service organization designates the specific control objectives, controls, and period to be covered. These criteria are intended to address the assurance needs of a broad range of user-entities and reduce the need for the service organization to undergo separate audits by each user-entity. Exhibit 2 presents a comparison of SOC 1, Type 1 and 2 reports.

As depicted, a SOC 1 engagement culminates in a report issued by the service organization’s auditor that includes a description of the system of interest and the suitability of the design of the controls to achieve the related control objectives (Type 1 and 2 reports). A Type 2 Report also includes the results of an examination of the operating effectiveness of the controls over a specified time-period to achieve the related control objectives. A Type 2 Report should be requested by issuer-users that are required to have assurance that their service organizations’ financial reporting controls applicable to material outsourced processes are operating effectively.

Complicating the SOC 1 process, service organizations may choose to outsource their own critical business processes to subservice organizations. If a subservice organization is referenced in a SOC 1 report, the service organization may or may not require its auditor to perform an examination (or obtain a SOC 1 report) of the controls related to the critical business processes that have been outsourced to the subservice organization. When an examination of the subservice organization’s controls is not performed, the service organization’s SOC 1 report must: 1) reference the use of subservice organizations considered critical to the business process covered by the SOC 1 report (AS 2601.54, AT-C sections 320.A67, and 320.A11), and 2) include an explicit statement that the service organization-auditor has not examined these “carved-out” controls (AT-C section 320.08).

If user-entities or their auditors determine that: 1) a service organization’s relevant controls have not been examined or important controls have been carved out, 2) the report includes control deficiencies, or 3) the time-period covered by the SOC 1 report is insufficient, additional steps should be taken to determine if controls are adequate. These steps may include inquiries of the service organization and the service organization’s auditor.

The Survey

To learn more about how companies use and rely on SOC 1 reports, surveys were sent to 1,724 CFOs, CAEs, and ACMs of issuers. The potential participants were from lists: 1) purchased from a provider of emails of CFOs of Fortune 1000 companies, 2) borrowed from a national accounting and audit service provider, and 3) obtained through online searches of ACMs of publicly traded companies. A chapter of Financial Executives International and a chapter of the Institute of Internal Auditors also generously agreed to send a link to the survey to its members. Of the potential participants, 30 completed the survey. Twelve participants were CFOs, ten were CAEs, and eight were ACMs. The participants represent issuers with more than $2 billion market capitalization (53%), and issuers between $75 million and $2 billion market capitalization (47%). The participants represented a variety of industries.

The survey began by providing definitions of a service organization, SOC 1–Type 1 and Type 2 reports, and an example process and its subprocesses. The participants could refer to these definitions while completing the survey. Next, the survey asked participants whether their companies outsourced any of the processes detailed in Exhibit 1. If a participant responded that none of the processes was outsourced, or if they responded, “don’t know,” they were taken to the end of the survey. Not all of the participants completed all of the survey questions.

Results

Exhibit 3 presents the participants’ responses about process outsourcing.

As shown in Exhibit 3, most participants indicated that their company outsources all or portions of its information technology (IT) and data management process (72%) and payroll or human resources process (69%). Approximately 21% outsource portions of their procurement to payment process, 21% outsource portions of their finance and accounting process, and 17% outsource portions of their customer order to collection process. Three participants (10%) reported no outsourced processes, and two participants (7%) reported not knowing whether processes were outsourced.

If a participant responded affirmatively to outsourcing a business process, they were next asked whether identified processes were critical to their company’s systems of internal control or likely to have a material impact on the financial statements. The participants reported outsourcing 177 processes (mean = 7.08 subprocesses per participant). Of the 177 process observations, 116 (65%) were considered critical. For only two processes (out of 177) did the participants report “don’t know” to the question about whether the outsourced process was critical.

Participants were then asked whether a SOC 1 (Types 1 and 2) report was obtained. The authors expected that, for processes considered critical, a SOC 1–Type 2 report would be obtained from the issuer’s service organization. This was not the case, however. Of the 116 processes considered critical, participants affirmed that a SOC 1–Type 2 report was obtained for 64%. For 11% of the critical processes a SOC 1–Type 1 report was obtained, and for 9% neither type of SOC 1 report was obtained. For 16% of the critical processes, the participants reported not knowing whether a SOC 1 report was obtained. The participants’ responses do not appear to be related to their titles or company size.

Next, if a participant reported obtaining a SOC 1–Type 2 report, they were asked to respond to survey questions specific to their service organizations’ reports. For the participants responding to these questions, most indicated that the service organization-auditor was a Big Four or Next Four auditor (81%).

The most common response to questions about SOC 1 reports referencing subservice organizations was “yes” (45%), followed by “don’t know” (38%). Despite reporting that the user’s auditors commonly rely on SOC 1–Type 2 reports (74%), most of the participants did not know whether SOC 1 reports of subservice organizations were obtained (51%); and making inquiries of service organizations and service organization-auditors appears to be the exception (26% and 2%, respectively). This lack of information increases the risk of outsourcing, as subservice organizations could, among other things, have significant control deficiencies. It may be that service organizations fail (intentionally or unintentionally) to obtain SOC 1–Type 2 reports from their subservice organizations.

Two final survey questions were specific to audit committee communications. Of the participants responding to these questions, most reported that the audit committee is made aware that auditors rely on SOC 1 reports (59%), but less than one-quarter (23%) reported that the audit committee makes inquiries about SOC 1 reports.

Insights and Implications

The survey results suggest that companies most frequently out-source all or portions of their IT and data management processes, and payroll or human resources processes. While companies have outsourced payroll processes for years, the outsourcing of IT and data management is a more recent phenomenon. This increases the possibility that IT and data management service organizations may have less developed systems of internal control, may be less likely to have SOC 1–Type 2 reporting, and user-entities may have fewer controls to manage relationships with their IT and data management service organizations. Given that all the participants in this study are associated with issuers, the risk is likely greater that other entities (e.g., non-issuers, non-profits) may unintentionally expose themselves to outsourcing risks. CPAs can help their clients and employers reduce the financial reporting risks of outsourcing by engaging with managers and audit committees. For example, discussing the potential range of process outsourcing by providing a list (like that in Exhibit 1) might reveal outsourcing relationships not previously considered. Asking managers how they know whether their service organizations’ internal controls are effective could prompt a conclusion about the need to obtain SOC 1–Type 2 reports from service organizations and relevant subservice organizations.

The survey results also suggest that it is likely that SOC 1–Type 2 reports are not obtained for all outsourced processes considered critical to user-entities’ systems of internal control or likely to have a material impact on the financial statements. While informative, SOC 1–Type 1 reports do not provide assurance that service organizations’ controls are operating effectively. Furthermore, although SOC 1–Type 2 reports frequently reference subservice organizations, there appears to be a lack of awareness about the quality of SOC 1 subservice organizations’ internal controls. Accountants and auditors should ensure that SOC 1 reports address all the risks associated with user-entities’ outsourced processes.

It is possible that some managers view the process of obtaining SOC 1 reports as a “check the box” exercise. But because users typically do not determine the objectives, controls, or time-period covered by a SOC 1 engagement, SOC 1 reports must be scrutinized to ensure that the service organization’s auditor has evaluated all controls relevant to the user over the correct time-period.

Despite these identified outsourcing risks, only about half of the participants reported that audit committees are made aware of managers’ and user-auditors’ reliance on SOC 1 reports, and fewer than half of the participants reported that their audit committees inquire about SOC 1 reports. This suggests that ACMs may not be well informed about outsourcing risks. CPAs should consider recommending that ACMs inquire about all outsourced processes, and critical IT and data management processes in particular. Inquiries should include how the processes are managed, whether assurance in the form of SOC 1–Type 1or Type 2 reports is obtained, and what steps are taken with respect to understanding the role of service organizations’ subservice organizations.

Outsourcing is ubiquitous. The results discussed above can help CPAs improve the use of SOC 1 reports and reduce the financial reporting risks associated with outsourcing.