The American Institute of Certified Public Accountants does not mandate a minimum testing and reporting period for System and Organization Controls (SOC) reports. Instead, it suggests a reporting period of at least six months. Reports covering less than six months may not provide meaningful results to end users.
Whether for SOC 1 or SOC 2, a Type 1 report covers procedures and controls at a certain point in time. Type 2 reports cover the existence and performance of procedures and internal controls over time.
If the organization is commissioning a SOC report for the first time, an auditor may agree to a shorter reporting period. A short reporting period might also be appropriate when an organization has made changes to its system or scope of the SOC examination (e.g., included additional applications or services covered by the examination) or has made other key changes that would impact the SOC report. Once the changes have been implemented and sufficient time has passed to allow controls to operate, the SOC reporting period should revert to at least a six-month period.
Management of a service organization is often asked to issue a bridge letter when a SOC report only covers a portion of the calendar or fiscal year of its customers. Since management issues the bridge letter, there’s no auditor assurance. However, it does provide management’s representation regarding changes made to the organization’s controls or confirmation regarding the lack of changes from the SOC report’s date to the effective date of the bridge letter.
Schneider Downs employs a unique approach to SOC reports, integrating the expertise of information technology, internal audit, and external audit professionals. By combining cross-disciplinary knowledge and project management expertise, we are able to effectively deliver on our clients’ expectations. If you are interested in learning how we can assist your organization, please contact us to get started or learn more about our practice at www.schneiderdowns.com/soc.
