Audit Firms
You will need to select an audit firm to perform an audit for your desired compliance framework. Depending on the scope of your needs, you'll want to consider various criteria when choosing an audit partner.
You will need to select an audit firm to perform an audit for your desired compliance framework. Depending on the scope of your needs, you'll want to consider various criteria when choosing an audit partner.
Planning and preparing for a compliance audit, including timelines, scoping, stakeholder identification, gap analysis, and audit firm selection
Auditors test controls in defined stages, and each stage expects specific kinds of evidence. Testing will occur for the different criteria and controls that have been implemented by the service organization. For example, the testing and evidence for availability will be different than that of privacy.
Your System and Organization Controls 2 (SOC 2) is only valid for a year after your audit. If you’re behind on renewing your SOC 2 report and it falls past the date in which it’s valid, you may need a SOC 2 bridge letter. The letter maintains trust with your customers while you renew the report.
How to define the system scope for a compliance audit, including services, systems, Trust Services Categories, and subservice organizations
Answers to the questions we hear most often about System and Organization Controls 2 (SOC 2): whether it is required, how the attestation works, and what the process costs in time and money.
Identifying the people in your organization responsible for control design, evidence collection, policies, and the system description during an audit
Evidence management for compliance programs and audit preparation
Comprehensive guide to Sarbanes-Oxley Act (SOX) compliance requirements, internal controls, financial reporting, and audit requirements for publicly traded companies
Comprehensive guide to SOC 2 compliance including Trust Services Criteria, AICPA framework, implementation timeline, costs, and audit requirements for service organizations
What the SOC 2 system description is, the sections auditors expect it to contain, who writes it, when to write it, and how an inaccurate description can affect your audit opinion