SOC (System and Organization Controls – formerly Service Organization Controls) audits are an independent assessment of the risks associated with using service organisations and other third parties. They are essential to regulatory oversight, vendor management programmes, internal governance and risk management.

There are three levels of SOC audit for service organisations:

• SOC 1 audits relate to organisations’ ICFR (internal control over financial reporting). They are conducted against the assurance standards ISAE (International Standard for Assurance Engagements) 3402 or SSAE (Statement on Standards for Attestation Engagements) 18.
• SOC 2 audits assess service organisations’ security, availability, processing integrity, confidentiality and privacy controls against the AICPA’s (American Institute of Certified Public Accountants) TSC (Trust Services Criteria), in accordance with SSAE 18. A SOC 2 report is generally used for existing or prospective clients.

In the UK, SOC 2 audits can also be carried out against ISAE 3000. You can learn more about using the ISAEs for SOC 2 examinations in the AICPA document Performing and reporting on a SOC 2® examination. SOC 3 audits are like SOC 2 audits, but their reports are much more concise and designed for a general audience. SOC 1 and SOC 2 audits are divided into two types:

• Type 1 – an audit carried out on a specified date.
• Type 2 – an audit carried out over a specified period, usually a minimum of six months.

SOC 3 audits are always Type 2.

The AICPA has also developed SOC for cybersecurity and SOC for Supply Chain.

At Marcum Darby, we recognize that readiness is the first and perhaps most critical step in the SOC 2 process. Our knowledgeable team will conduct an in-depth review of your current control environment against SOC 2 requirements to identify any gaps. This gap analysis will not only help us understand your current stance but also assist us in creating a tailored action plan to help you meet and exceed SOC 2 standards. We pave the way for a seamless SOC 2 audit by helping you understand the requirements, set realistic expectations, and make the necessary preparations.

Collecting appropriate and sufficient evidence is vital to demonstrate your compliance with SOC 2 requirements. Our dedicated team utilizes best-in-class automation tools to streamline the evidence collection process, ensuring the necessary data is acquired efficiently and accurately. We guide you on what to collect, how to collect, and where to store your data securely, reducing the burden on your resources and minimizing any disruption to your daily operations.

Once readiness checks and evidence collection are completed, the next step is fieldwork. Our expert auditors will conduct a comprehensive review of your control environment, ensuring that every control point is covered. This is where our automation technology truly shines, aiding in exhaustive analysis and auditing processes while significantly reducing the time and resources required. With Marcum Darby, rest assured that you're under the guidance of an expert team that is committed to ensuring thoroughness and efficiency in every stage of the audit.

We understand that the SOC 2 report is a vital document that communicates your compliance with SOC 2 standards to your stakeholders. We produce detailed yet comprehensible reports that include our findings, recommendations, and your overall compliance level. Each report is customized to your unique needs, allowing you to showcase your commitment to data security and compliance.

Following the report, our team will help you address any highlighted areas for improvement, assisting in your remediation efforts and preparing you for your SOC 2 accreditation. We believe that accreditation is more than just a certificate—it's a testament to your company’s commitment to best-in-class data security and compliance. At Marcum Darby, we're not just your auditors, but your partners, committed to guiding you every step of the way to accreditation.

Once you achieve your SOC 2 accreditation, it’s time to let the world know about your commitment to data security, integrity, and privacy. We offer guidance on how best to communicate your new status to stakeholders, emphasizing the value it brings to your clients and your business. We believe in celebrating and leveraging this significant achievement to enhance your market position.