Today’s businesses have seen a dramatic increase in the use of outsourced providers to assist in executing processes across payroll, accounts payable, information technology, benefit plan administration and many other core functions. These processes ultimately have an impact on an organization’s internal control over financial reporting, but could also impact compliance and operational issues

In 2011, the Statement on Standards for Attestation Engagements (SSAE) 16 replaced the former Statement on Auditing Standards (SAS) 70. In May 2017, a new standard, SSAE 18, superseded SSAE 16

The concepts covered in this course are referred to as Service Organization Control (SOC) reports. Organizations that utilize outsourced providers should understand the various types of SOC reports, their intended uses and their implications for a company’s financial reporting process, regardless of whether the organization is publicly traded or privately held. The process can be difficult for a user organization to understand. Currently, several types of SOC Reports exist, including:

• SOC 1 - Type 1
• SOC 1 - Type 2
• SOC 2 - Type 1
• SOC 2 - Type 2
• SOC 3
• Cybersecurity SOC

This course briefly addresses the transition from SAS 70 to SSAE 16 and now to SSAE 18. However, the focus is on the various Service Organization Control Reports, their purposes and uses