IT Audit and Compliance Partner

Organizations that perform services, or provide products, that have a material impact on a client’s financial statements are candidates for a SOC 1 report.

Any organization that provides systems or services to clients and receives, processes, or maintains client data. This would include SaaS and IaaS solutions, healthcare entities, financial institutions, and professional services firms just to name a few.

As an alternative to a SOC report, an organization may utilize SSAE19 - Agreed-Upon Procedures (AUP) to provide assurances only on specific controls.

This may be a valuable solution for small and medium size businesses that don’t have the resources to complete a full SOC report.