SSAE SOC Audits: Auditee - Auditor - Assessor Training

Fundamental changes have come to Service Organization Control (SOC) reports in the last ten years. In 2011, SAS 70 was superseded by the SSAE 16, and then in May 2017, SSAE 18 become effective.

​This move to Statement of Auditing Engagements (SSAE 18) brings along with it significant updates which strengthen the overall quality of the SOC reports.

​You will learn about the SOC framework in this event. Known as Service Organization Control (SOC) reports, the SOC framework is a radical departure from the one-size-fits-all approach held by SAS 70 for approximately twenty (20) years.

In short, with three reporting options - SOC 1, SOC 2, and SOC 3 - service organizations have more flexibility and more choices regarding third-party assessments of their control environments. While SOC 1 has quickly become the dominant reporting option, SOC 2 and SOC 3 are extremely viable, especially for many of today's technology companies.

Attendees will understand:

• Internal control and risk management frameworks
• the AICPA standard for System and Organization Control audits (SSAE 18 SOC)
• the various types of SOC audits and their applicability
• the requirements to prepare for SOC engagements
• how SOC 1, SOC 2, and SOC 3 audits are conducted
• how to interpret the SOC reports
• the identification and testing of internal controls in SOC reports
• the responsibilities for user entities and testing of user controls
• how to document the tests of controls
• common SOC audit internal control deficiencies
• how auditors form their SOC audit opinion
• the new types of SOC reports
• the role of SOC audits in Vendor Management Programs

Section 1 - Introduction and Overview of SSAE 18
Section 2 - Types of SSAE 18 Audits
Section 3 - Components of the Audit Report
Section 4 - Sample Reports
Section 5 - SOX, COSO and SSAE 18
Section 6 - The SSAE 18 Data Center Audit
Section 7 - How to Conduct the SSAE 18 Audit
Section 8 - Developing the System Description
Section 9 - Summary of Concepts
Section 10 - Testing of Controls
Section 11 - IT Control Frameworks
Section 12 - Testing the Physical Security Controls
Section 13 - Testing the Logical Security Controls
Section 14 - Testing the Changes Controls
Section 15 - Testing Operations, Backup and Restoration Controls
Section 16 - Testing the IPO and User Controls
Section 17 - Evaluating the SSAE 18 Report
Section 18 - Going Forward with Your Vendor Management Program

This CPE event focusing on SSAE SOC Audits offers comprehensive training for auditees, auditors, and assessors involved in System and Organization Controls (SOC) audits conducted in accordance with the Statement on Standards for Attestation Engagements (SSAE). This in-person training event is designed to equip participants with the knowledge, skills, and best practices essential for navigating the intricacies of SOC audits, thereby fostering a thorough understanding of the roles, responsibilities, and requirements inherent to the audit process.

Key focus areas covered in this event may include:

• Regulatory Framework and SSAE Compliance: An exploration of the regulatory framework and compliance requirements outlined by the SSAE pertaining to SOC audits, shedding light on the attestation standards and reporting considerations essential to conducting effective and compliant audits.

• Auditee Preparation and Responsibilities: Insights into the preparatory measures, documentation requirements, and responsibilities incumbent upon auditees undergoing SOC audits, emphasizing the significance of accurate, transparent, and comprehensive representations of their control environments.

• Auditor Methodologies and Examination Techniques: Comprehensive guidance on the methodologies, examination procedures, and assessment techniques employed by auditors and assessors during SOC audits, empowering participants with the tools necessary to execute thorough, insightful, and value-driven audit engagements.

• Assessor Training and Professional Development: A focus on the training and professional development opportunities available for individuals seeking to enhance their skill set as assessors within the realm of SOC audits, fostering continuous learning, competence, and proficiency in audit practices.

By addressing these critical components, the in-person training event aims to fortify the competencies of auditees, auditors, and assessors, ultimately contributing to the delivery of robust, reliable, and value-adding SOC audit engagements in alignment with regulatory mandates.

After attending the CPE event on SSAE SOC Audits: Auditee - Auditor - Assessor Training, you can continue to expand your knowledge and expertise by exploring additional resources from authoritative sources in the field of auditing and compliance. These sources provide valuable insights and in-depth content to further enhance your understanding in this domain:

• American Institute of Certified Public Accountants (AICPA)
  • The AICPA offers a wealth of resources, including technical guides, research reports, and news updates related to auditing standards, SOC audits, and compliance practices.
• The Institute of Internal Auditors (IIA)
  • The IIA provides extensive resources, publications, and educational materials focused on internal audit practices, including guidance on SOC audits and related industry standards.

By leveraging these authoritative sources, you can deepen your knowledge, stay updated on industry best practices, and continue your professional development in the realm of SSAE SOC audits and compliance practices.