SECTION I INDEPENDENT SERVICE AUDITOR S REPORT
|
|
|
- Eleanore Campbell
- 8 years ago
- Views:
Transcription
1 SOC2 Security Report on Controls Supporting DriveSavers Services Independent Service Auditor s Report on Design of Controls Placed in Operation and Tests of Operational Effectiveness Relevant to Security (SOC2) For the Period of April 16, 2014 to April 15, 2015
2 SECTION I INDEPENDENT SERVICE AUDITOR S REPORT PROVIDED BY GOETSCH & ASSOCIATES June 1, 2015 Board of Directors DriveSavers Data Recovery Inc. (DriveSavers) 400 Bel Marin Keys Boulevard Novato, CA Re: SOC2 Type II Security Examination Results We have examined the accompanying description of controls related to the services of DriveSavers Data Recovery Inc. (DriveSavers), titled Section III DriveSavers System Description, for the period April 16, 2014 to April 15, 2015 (the description) and the suitability of the design and operating effectiveness of controls to meet the criteria for security principles set forth in TSP section 100, Trust Services Principles, Criteria, and Illustrations for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, Technical Practice Aids) (applicable trust services criteria), throughout the period April 16, 2014 to April 15, The description indicates that certain applicable trust services criteria specified in the description can be achieved only if complementary user-entity controls contemplated in the design of the service organization s controls are suitably designed and operating effectively, along with the related controls at the service organization. We have not evaluated the suitability of the design or operating effectiveness of such complementary user entity controls identified in Section III C., titled C. Complementary Controls at Client / User Organization. The service organization has provided their accompanying assertion titled Section II DriveSavers Management Assertion for the period April 16, 2014 to April 15, 2015, which is based on the criteria identified in management s assertion. The service organization is responsible for (1) preparing the description and the assertion; (2) the completeness, accuracy, and method of presentation of both the description and assertions; (3) providing the services covered by the description; (4) specifying the controls that meet the applicable trust services criteria and stating them in the description; and (5) designing, implementing, and documenting the controls to meet the applicable trust services criteria. Our responsibility is to express an opinion on the fairness of the presentation of the description based on the description criteria set forth in the service organization s assertion and on the suitability of the design and operating effectiveness of the controls to meet the applicable trust services criteria, based on our examination. We conducted our examination in accordance with attestation standards established by the American Institute of Certified Public Accountants (AICPA). Those standards require that we plan and perform our examination to obtain reasonable assurance about whether, in all material respects, (1) the description is fairly presented based on the description criteria, and (2) the controls were suitably designed and operating effectively to meet the applicable trust services criteria throughout the period April 16, 2014 to April 15, Our examination involved performing procedures to obtain evidence about the fairness of the presentation of the description based on the description criteria and the suitability of the design and operating effectiveness of those controls to meet the applicable trust services criteria. Our procedures included assessing the risks that the description is not fairly presented and that the controls were not suitably designed or operating effectively to meet the applicable trust services criteria. Our procedures also included testing the operating effectiveness of those controls that we consider necessary to provide reasonable assurance that the applicable trust services criteria were met. Our examination also included evaluating the overall presentation of the description. We believe that the evidence we obtained is sufficient and appropriate to provide a reasonable basis for our opinion.
3 Because of their nature and inherent limitations, controls at a service organization may not always operate effectively to meet the applicable trust services criteria. Also, the projection to the future of any evaluation of the fairness of the presentation of the description or conclusions about the stability of the design or operating effectiveness of the controls to meet the applicable trust services criteria is subject to the risks that the system may change or that controls at a service organization may become inadequate or fail. In our opinion, in all material respects, based on the description criteria identified in DriveSavers' assertion and the applicable trust services criteria: The description fairly presents the system that was designed and implemented throughout the period April 16, 2014 to April 15, The controls stated in the description were suitably designed to provide reasonable assurance that the applicable trust services criteria would be met if the controls operated effectively throughout the period April 16, 2014 to April 15, 2015, and user entities applied the complementary user-entity controls contemplated in the design of DriveSavers controls throughout the period April 16, 2014 to April 15, The controls tested, which together with the complementary user-entity controls referred to in the scope paragraph of this report, if operating effectively, were those necessary to provide reasonable assurance that the applicable trust services criteria were met, operated effectively throughout the period April 16, 2014 to April 15, The specific controls we tested and the nature, timing, and results of our tests are presented in the section of our report titled Section IV Testing. This report and the description of tests of controls and results thereof are intended solely for the information and use of DriveSavers user entities during some or all of the period April 16, 2014 to April 15, 2015; independent auditors and practitioners providing services to such user entities, and regulators who have sufficient knowledge and understanding of the following: The nature of the service provided by the service organization How the service organization s system interacts with user entities, and other parties Internal control and its limitations Complementary user-entity controls and how they interact with related controls at the service organization to meet the applicable trust services criteria The applicable trust services criteria The risks that may threaten the achievement of the applicable trust services criteria and how controls address those risks This report is not intended to be and should not be used by anyone other than these specified parties. Goetsch & Associates CPA s PLLC Certified Public Accountants 2038 Caribou Drive, Suite 201 Fort Collins, CO 80525
4 SECTION II DRIVESAVERS MANAGEMENT ASSERTION PROVIDED BY DRIVESAVERS We have prepared the attached description titled SECTION III - DriveSavers System Description for the period April 16, 2014 to April 15, 2015 (the description) based on the criteria in items (c) (i)-(ii) below, which are the criteria for a description of a service organization s system in paragraphs of the AICPA Guide Reporting on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (the description criteria). The description is intended to provide users with information about the DriveSavers Data Recovery Systems, particularly system controls intended to meet the criteria for the security Principles set forth in TSP section 100, Trust Services Principles, Criteria and Illustrations for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA Technical Practice Aids) (applicable trust services criteria). We confirm, to the best of our knowledge and belief, that a. The controls stated in description were suitable designed throughout the specified period to meet the applicable trust services criteria. b. The controls stated in the description operated effectively throughout the specified period to meet the applicable trust service criteria. c. The description fairly presents the DriveSavers Data Recovery system throughout the period April 16, 2014 to April 15, 2015, based on the following description criteria: i. The description contains the following information: (1) The types of services provided (2) The components of the system used to provide the services, which are the following: Infrastructure. The physical and hardware components of a system (facilities, equipment, and networks). Software. The programs and operating software of a system (system applications, and utilities). People. The personnel involved in the operation and use of a system (developers, operators, users, and managers). Procedures. The automated and manual procedures involved in the operation of a system. Data. The information used and supported by a system (transactions streams, files, databases, and tables). (3) The boundaries or aspects of the system covered by the description (4) How the system captures and addresses significant events and conditions (5) The process used to prepare and deliver reports and other information to user entities and other parties (6) If information is provided to, or received from, subservice organizations or other parties, how such information is provided or received; the role of the subservice organization and other parties; and the procedures performed to determine that such information and its processing, maintenance, and storage are subject to appropriate controls (7) For each principle being report on, the applicable trust services criteria and the related controls designed to meet those criteria, including, as applicable, complementary user entity controls contemplated in the design of the service organization s system (8) For subservice organizations presented using the carve-out method, the nature of the services provided by other subservice organization each of the applicable trust services criteria that are intended to be met by controls at the subservice organization, alone or in combination with controls at the service organization, and the types of controls expected to be implemented at carved-out subservice organizations to meet those criteria; and for
5 ii. privacy, the types of activities that the subservice organization would need to perform to comply with our privacy commitments (9) Any applicable trust services criteria that are not addressed by a control at the service organization or a subservice organization and the reasons therefore (10) Other aspects of the service organization s control environment, risk assessment process, information and communication systems, and monitoring of controls that are relevant to the services provided and the applicable trust services criteria (11) Relevant details of changes to the service organization s system during the period covered by the description The description does not omit or distort information relevant to the service organization s system while acknowledging that the description is prepared to meet the common needs of a broad range of users and may not, therefore, include every aspect of the system that each individual user may consider important to his or her own particular needs. Michael Hall Chief Information Security Officer DriveSavers Data Recovery Inc.
SSAE 16 SOC 1 Type 2
SSAE 16 SOC 1 Type 2 Independent Service Auditor s Report on Management s Description of a Service Organization s System and the Suitability of the Design and Operating Effectiveness of Controls September
Information for Management of a Service Organization
Information for Management of a Service Organization Copyright 2011 American Institute of Certified Public Accountants, Inc. New York, NY 10036-8775 All rights reserved. For information about the procedure
Service Organization Control Reports
SAS 70 ENDS EXIT TO SSAE 16 Service Organization Control Reports What Did We Learn from Year One? Agenda Definitions Service Organization Reports What are they? Year One Experiences SSAE 16 Year One Experiences
Frequently asked questions: SOC 2 and 3
1. Is the licensing requirement for a SOC 2 or 3 different than for a SOC 1? SOC reports are attestation reports issued in accordance with AICPA standards. Therefore, licensing requirements are the same
The Changing SAS 70 Landscape Dan Hirstein Director Rebecca Goodpasture Senior Manager Deloitte & Touche LLP January 13, 2011
The Changing SAS 70 Landscape Dan Hirstein Director Rebecca Goodpasture Senior Manager Deloitte & Touche LLP January 13, 2011 Table of Contents A Short History of SAS 70 Overview of SSAE 16 and ISAE 3402
Reporting on Controls at a Service Organization
Reporting on Controls at a Service Organization 1529 AT Section 801 Reporting on Controls at a Service Organization (Supersedes the guidance for service auditors in Statement on Auditing Standards No.
Goodbye, SAS 70! Hello, SSAE 16!
Goodbye, SAS 70! Hello, SSAE 16! A Session to Provide Insight on the New Standard and What Service Providers and End-Users Need to Know January 3, 2012 Agenda Introduction Background on what was SAS 70
Service Organizations: Auditing Interpretations of Section 324
Service Organizations 1835 AU Section 9324 Service Organizations: Auditing Interpretations of Section 324 1. Describing Tests of Operating Effectiveness and the Results of Such Tests.01 Question Paragraph.44f
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Understanding SOC 3
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Understanding SOC 3 Agenda 1) A brief perspective on where SOC 3 originated
SAS No. 70, Service Organizations
SAS No. 70, Service Organizations A standard for reporting on a service organization s controls affecting user entities' financial statements. Only for use by service organization management, existing
Ayla Networks, Inc. SOC 3 SysTrust 2015
Ayla Networks, Inc. SOC 3 SysTrust 2015 SOC 3 SYSTRUST FOR SERVICE ORGANIZATIONS REPORT July 1, 2015 To December 31, 2015 Table of Contents SECTION 1 INDEPENDENT SERVICE AUDITOR S REPORT... 2 SECTION 2
Shared Service System Audits: What User Management and Auditors Need to Know
Shared Service System Audits: What User Management and Auditors Need to Know JFMIP May 2014 Presented by: Robert Dacey GAO Session Objectives Properly using SSAE 16 service organization audit reports Revisions
Reports on Service Organizations Where we ve been?
Reports on Service Organizations Where we ve been? What s changing? How does this impact Internal Audit? Eric Wright Shareholder Frank Dezort Senior Manager Schneider Downs & Co., Inc. May 2, 2011 Overview
3.B METHODOLOGY SERVICE PROVIDER
3.B METHODOLOGY SERVICE PROVIDER Approximately four years ago, the American Institute of Certified Public Accountants (AICPA) issued Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting
Feeley & Driscoll, P.C. Certified Public Accountants / Business Consultants www.fdcpa.com. Visit us on the web: www.fdcpa.com Or Call: 888-875-9770
Feeley & Driscoll, P.C. Certified Public Accountants / Business Consultants www.fdcpa.com SAS 70 Background 2 SAS No. 70 Reports on the Processing of Transactions by Service Organizations Independent examination
At a glance. A provision to require a written assertion from company management is the most notable difference between the two standards.
At a glance While there are some differences, SAS 70 and SSAE 16 are substantially the same. SAS 70 is an audit standard while SSAE 16 is an attest standard. Out with the old SAS 70 and in with the new
INTERNATIONAL STANDARD ON ASSURANCE ENGAGEMENTS (ISAE) 3402 ASSURANCE REPORTS ON CONTROLS AT A SERVICE ORGANIZATION
INTERNATIONAL STANDARD ON ASSURANCE ENGAGEMENTS (ISAE) 3402 ASSURANCE REPORTS ON CONTROLS AT A SERVICE ORGANIZATION (Effective for service auditors assurance reports covering periods ending on or after
SERVICE ORGANIZATION CONTROL REPORTS SM. Formerly SAS 70 Reports
SERVICE ORGANIZATION CONTROL REPORTS SM Formerly SAS 70 Reports SAS No. 70, Service Organizations Standard for reporting on a service organization s controls affecting user entities financial statements
SSAE 16 for Transportation & Logistics Companies. Chris Kradjan Kim Koch
SSAE 16 for Transportation & Logistics Companies Chris Kradjan Kim Koch 1 The material appearing in this presentation is for informational purposes only and should not be construed as advice of any kind,
Service Organization Control (SOC) Reports Focus on SOC 2 Reporting Standard
Information Systems Audit and Controls Association Service Organization Control (SOC) Reports Focus on SOC 2 Reporting Standard February 4, 2014 Tom Haberman, Principal, Deloitte & Touche LLP Reema Singh,
SSAE 16 and ISAE 3402: Preparing for New Service Company Control Standards Mastering Requirements Governing Your Next Controls Report
Presenting a live 110 minute teleconference with interactive Q&A SSAE 16 and ISAE 3402: Preparing for New Service Company Control Standards Mastering Requirements Governing Your Next Controls Report WEDNESDAY,
Farewell to SAS 70. What you need to know about the New Standard for Service Organization Reporting
Farewell to SAS 70 What you need to know about the New Standard for Service Organization Reporting ADVISORY rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative
FAQs New Service Organization Standards and Implementation Guidance
FAQs New Service Organization Standards and Implementation Guidance During the past two years several significant changes have occurred in audit and attest standards for reporting on controls at service
PAYMENTS FOR SPECIFIED ENERGY PROPERTY IN LIEU OF TAX CREDITS INDEPENDENT ACCOUNTANT REQUIREMENTS
9/24/09 PAYMENTS FOR SPECIFIED ENERGY PROPERTY IN LIEU OF TAX CREDITS INDEPENDENT ACCOUNTANT REQUIREMENTS Applicants requesting payments of $ 1 Million or more for a specified property shall submit an
About the Presenter. Presentation Objectives. SaaS / Cloud Computing Risk Management AICPA Attest Alternatives
SaaS / Cloud Computing Risk Management AICPA Attest Alternatives Presenter: Dan Schroeder, CPA/CITP Habif, Arogeti, & Wynne, LLP Georgia Society of CPAs Annual Convention June 16, 2010 About the Presenter
Service Organization Control (SOC 3) Report on a Description of the Data Center Colocation System Relevant to Security and Availability
15301 Dallas Parkway, Suite 960, Addison, TX 75001 MAIN 214 545 3965 FAX 214 545 3966 www.bkmsh.com Service Organization Control (SOC 3) Report on a Description of the Data Center Colocation System Relevant
Understanding SOC Reports for Effective Vendor Management. Jason T. Clinton January 26, 2016
Understanding SOC Reports for Effective Vendor Management Jason T. Clinton January 26, 2016 MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2012 Wolf & Company, P.C. Before we
Webtrends Inc. Service Organization Controls (SOC) 3 SM Report on the SaaS Solutions Services System Relevant to Security
Webtrends Inc. Service Organization Controls (SOC) 3 SM Report on the SaaS Solutions Services System Relevant to Security For the Period January 1, 2015 through June 30, 2015 SOC 3 SM SOC 3 is a service
MAG DATACENTERS, LLC ( FORTRUST ) Service Organization Controls 3
MAG DATACENTERS, LLC ( FORTRUST ) Service Organization Controls 3 Report on FORTRUST s Enterprise Data Center and Colocation Services System Relevant to Security and Availability For the Period October
MHM S PERSPECTIVE: CHANGES COMING TO SAS 70.KNOW THE FACTS
Mayer Hoffman McCann P.C. An Independent CPA Firm MHM S AUDITING PERSPECTIVE: STANDARD NO. 5 Since its issuance in 1992, the American Institute of Certified Public Accountants (AICPA) Statement on Auditing
Monitoring Outside Service Providers, Part III: SAS 70 Updates
Monitoring Outside Service Providers, Part III: SAS 70 Updates Richard F. Fischer, CPA Louis Plung & Company, LLP richard.fischer@louisplung.com 412-281-8771 CHANGES TO SAS 70 SERVICE ORGANIZATIONS: Statement
SECTION I: REPORT OF INDEPENDENT SERVICE AUDITORS... 3 SECTION II: MANAGEMENT OF INTERNAP NETWORK SERVICES CORPORATION'S ASSERTION 5
SOC 2 - Availability Report on Internap Network Services Corporation's Description of its SEF Company-Controlled Data Center System and Suitability of Design and Operating of Controls Throughout the Period
Service Organization Controls 3 Report. Report on Hyland Software, Inc. s OnBase Online Cloud Platform, relevant to Security and Availability
Service Organization Controls 3 Report Report on Hyland Software, Inc. s OnBase Online Cloud Platform, relevant to Security and Availability for the period May 1, 2015 through October 31, 2015 Ernst &
Service Organization Control (SOC) Reports
Service Organization Control (SOC) Reports Transitioning from SAS 70 to SSAE 16 Deloitte & Touche LLP Agenda Overview SAS 70/SSAE 16 Historical Perspective The New Framework Under SSAE 16 (SOC 1) Impact
SECURITY AND EXTERNAL SERVICE PROVIDERS
SECURITY AND EXTERNAL SERVICE PROVIDERS How to ensure regulatory compliance and manage risks with Service Organization Control (SOC) Reports Jorge Rey, CISA, CISM, CGEIT Director, Information Security
CSA Position Paper on AICPA Service Organization Control Reports
CSA Position Paper on AICPA Service Organization Control Reports February 2013 2013, Cloud Security Alliance. All rights reserved. You may download, store, display on your computer, view, print, and link
Vendor Management Best Practices
23 rd Annual and One Day Seminar Vendor Management Best Practices Catherine Bruder CPA, CITP, CISA, CISM, CTGA Michigan Texas Florida Insight. Oversight. Foresight. SM Doeren Mayhew Bruder 1 $100 billion
Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions
Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions Plan Advisory The AICPA EBPAQC is a firm-based, volunteer membership center created with the goal of promoting quality employee
ASSESSMENT REPORT 13 19. Federal PKI Compliance Report September 6, 2013
ASSESSMENT REPORT 13 19 Federal PKI Compliance Report September 6, 2013 Date September 6, 2013 To Chief Information Officer From Inspector General Subject Assessment Report Federal PKI Compliance Report
System Description of the Date Center System Relevant to Security and Availability (SOC 3) November 1, 2011 through April 30, 2012
System Description of the Date Center System Relevant to Security and Availability (SOC 3) November 1, 2011 through April 30, 2012 Moss Adams LLP 9665 Granite Ridge Drive, Suite 600 San Diego, CA 92123
TIS Section 9520, SSAE No. 16, Reporting on Controls at a Service Organization
November 2011 AICPA Technical Practice Aids TIS Section 9520, SSAE No. 16, Reporting on Controls at a Service Organization.01 New Standards for Service Auditors and User Auditors Inquiry Did the issuance
PAYMENTS FOR SPECIFIED ENERGY PROPERTY IN LIEU OF TAX CREDITS INDEPENDENT ACCOUNTANT REQUIREMENTS BEGUN CONSTRUCTION APPLICATIONS
PAYMENTS FOR SPECIFIED ENERGY PROPERTY IN LIEU OF TAX CREDITS INDEPENDENT ACCOUNTANT REQUIREMENTS BEGUN CONSTRUCTION APPLICATIONS Under Section 1603 of the American Recovery and Reinvestment Act of 2009
Service Organization Controls. Managing Risks by Obtaining a Service Auditor s Report
Service Organization Controls Managing Risks by Obtaining a Service Auditor s Report Contributing Authors Audrey Katcher, CPA/CITP, Partner at RubinBrown, LLP Janis Parthun, CPA/CITP, Sr. Technical Manager
Here comes SSAE 16 SAS 70 EVOLUTION: How will the new standard affect my business? How do I prepare to meet the new requirements?
SAS 70 EVOLUTION: Here comes SSAE 16 PLANNING FOR THE NEW SERVICE ORGANIZATION REPORTING STANDARDS The prevalence of SAS 70 audits has grown dramatically since the standards issuance in April of 1992.
Service Organization Control (SOC) reports What are they?
Service Organization Control (SOC) reports What are they? Jeff Cook, CPA, CITP, CIPT, CISA June 2015 Introduction Service Organization Control (SOC) reports are on the rise in the IT assurance and compliance
EPCS Third party audits the CPA perspective. 13 September 2012
EPCS Third party audits the CPA perspective 13 September 2012 Agenda Introduction History Report review Audit process Moving forward Introduction 1311.300 Application provider requirements Third-party
STANDING ADVISORY GROUP MEETING
1666 K Street, NW Washington, D.C. 20006 Telephone: (202) 207-9100 Facsimile: (202)862-8430 www.pcaobus.org STANDING ADVISORY GROUP MEETING BROKER-DEALER AUDIT CONSIDERATIONS JULY 15, 2010 Introduction
WELCOME TO SECURE360 2013
WELCOME TO SECURE360 2013 Don t forget to pick up your Certificate of Attendance at the end of each day. Please complete the Session Survey front and back, and leave it on your seat. Are you tweeting?
Understanding Vendor Risk And Analyzing the SSAE No. 16
Understanding Vendor Risk And Analyzing the SSAE No. 16 Accelerate your Credit Union s Performance June 19, 2014 AUSTIN, TEXAS www.cuaccelerator.com Agenda Vendor Management Key Outsourcing Risk Areas
IAASB Main Agenda (June 2010) Agenda Item. April 28, 2009
Agenda Item 8-B Statement of Position 09-1 April 28, 2009 Performing Agreed-Upon Procedures Engagements That Address the Completeness, Accuracy, or Consistency of XBRL-Tagged Data Issued Under the Authority
Agreed-Upon Procedures Engagements
Agreed-Upon Procedures Engagements 1323 AT Section 201 Agreed-Upon Procedures Engagements Source: SSAE No. 10; SSAE No. 11. Effective when the subject matter or assertion is as of or for a period ending
Documentation of Use of a Type 2 Service Auditor s Report In an Audit of an Employee Benefit Plan s Financial Statements
Documentation of Use of a Type 2 Service Auditor s Report In an Audit of an Employee Benefit Plan s Financial Statements PLAN NAME: PLAN YEAR END: CLIENT NUMBER: SCOPE OF PLAN AUDIT: LIMITED FULL Note:
The end of SAS70 what next for Performance Assurance?
Enhancing Trust and Transparency The end of SAS70 what next for Performance Assurance? A perspective on transitioning from SAS 70 to ISAE 3402 pwc Enhancing Trust and Transparency 1 Contents What you need
SOC 3 for Security and Availability
SOC 3 for Security and Availability Independent Practioner s Trust Services Report For the Period October 1, 2013 through September 30, 2014 Independent SOC 3 Report for the Security and Availability Trust
REPORT OF INDEPENDENT CERTIFIED PUBLIC ACCOUNTANTS
REPORT OF INDEPENDENT CERTIFIED PUBLIC ACCOUNTANTS To the Management of Internet Security Research Group: We have examined the assertion by the management of the Internet Security Research Group ( ISRG
Copyright 2015, American Institute of Certified Public Accountants, Inc. All Rights Re... STATEMENT ON STANDARDS FOR CONSULTING SERVICES
Page 1 of 7 Consulting Services CS Section STATEMENT ON STANDARDS FOR CONSULTING SERVICES Statements on Standards for Consulting Services are issued by the AICPA Management Consulting Services Executive
Guidance on Professional Judgment for CPAs
2015I17-066 Guidance on Professional Judgment for CPAs (Released by The Chinese Institute of Certified Public Accountants on March 26, 2015) CONTENTS 1 General Provisions...1 2 Necessity of professional
Financial Forecasts and Projections
Financial Forecasts and Projections 1345 AT Section 301 Financial Forecasts and Projections Source: SSAE No. 10; SSAE No. 11; SSAE No. 17. Effective when the date of the practitioner s report is on or
SOC Readiness Assessments. SOC Report - Type 1. SOC Report - Type 2. Building Trust and Confidence in Third-Party Relationships
Building Trust and Confidence in Third-Party Relationships Today s businesses rely heavily on outsourcing certain business tasks or functions to service organizations, even those that are core to their
Update on AICPA Assurance Services Executive Committee Activities
Update on AICPA Assurance Services Executive Committee Activities Amy Pawlicki Director Business Reporting, Assurance & Advisory Services and XBRL AICPA Agenda ASEC overview Summary of work streams by
SSAE 16 & SAS 70 A Primer on Changes to Service Organization Audit Standards
A Member of OneBeacon Insurance Group SSAE 16 & SAS 70 A Primer on Changes to Service Organization Audit Standards Author: Jack Fletcher, Risk Control Technology Specialist Published: November 2014 Executive
Effectively using SOC 1, SOC 2, and SOC 3 reports for increased assurance over outsourced operations. kpmg.com
Effectively using SOC 1, SOC 2, and SOC 3 reports for increased assurance over outsourced operations kpmg.com b Section or Brochure name Effectively using SOC 1, SOC 2, and SOC 3 reports for increased
SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS
SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS Jeff Cook November 2015 Summary Service Organization Control (SOC) reports (formerly SAS 70 or
Independent Service Auditor s Report
Independent Service Auditor s Report Microsoft Corporation Global Foundation Services Independent SOC 3 Report for the Security and Availability Trust Principle for Microsoft GFS 1 Independent Service
Tom J. Hull & Company Type 1 SSAE 16 2014
Tom J. Hull & Company Type 1 SSAE 16 2014 REPORT ON MANAGEMENT S DESCRIPTION OF TOM J. HULL & COMPANY S SYSTEM AND THE SUITABILITY OF THE DESIGN OF CONTROLS Pursuant to Statement on Standards for Attestation
Audit Considerations Relating to an Entity Using a Service Organization
Audit Considerations Relating to an Entity 349 AU-C Section 402 Audit Considerations Relating to an Entity Using a Service Organization Source: SAS No. 122; SAS No. 128. Effective for audits of financial
G24: Audits of Controls at a Service Organization: New Standards SSAE 16 and ISAE 3402 Duff Donnelly and Jeffrey Spivack, Grant Thornton LLP
G24: Audits of Controls at a Service Organization: New Standards SSAE 16 and ISAE 3402 Duff Donnelly and Jeffrey Spivack, Grant Thornton LLP Audits of controls at a service organization Roadmap to the
LATISYS HOLDINGS, LLC SOC
LATISYS HOLDINGS, LLC SOC 2 Type 2 Report on Latisys Colocation Services, Managed Hosting, and Managed Services System and on the Design and Operating Effectiveness of its Controls Relevant to Security
Asset Manager Guide to SAS 70. Issue Date: October 7, 2007. Asset
Asset Manager Guide to SAS 70 Issue Date: October 7, 2007 Asset Management Group A s s e t M a n a g e r G u i d e SAS 70 Table of Contents Executive Summary...3 Overview and Current Landscape...3 Service
End of the SAS 70 Era
End of the SAS 70 Era For years businesses that outsource have relied on SAS 70 reports on the internal controls of third party providers. The standard for those reports is changing. New Standards Replacing
/s/: [name of auditor] Date:
![/s/: [name of auditor] Date:](/thumbs/26/9216368.jpg "/s/: [name of auditor] Date:")
FORM OF AUDITOR ATTESTATION 1 [Do not include this attestation in the offering document. The original signed attestation shall be delivered to the FRBNY at the following address: FRBNY, TALF Compliance,
SOC 3 SYSTRUST FOR SERVICE ORGANIZATIONS REPORT
THE TELX GROUP SOC 3 SYSTRUST FOR SERVICE ORGANIZATIONS REPORT Report On Telx s Interconnection And Colocation Services Relevant To Security And Availability For the Period April 1, 2014 March 31, 2015
RE: PCAOB Rulemaking Docket Matter No. 004 Statement Regarding the Establishment of Auditing and Other Professional Standards
May 12, 2003 Office of the Secretary Public Company Accounting Oversight Board 1666 K Street, N.W. Washington, D.C. 20006-2803 RE: PCAOB Rulemaking Docket Matter No. 004 Statement Regarding the Establishment
Compliance Audits 2463. Effective for compliance audits for fiscal periods ending on or after June 15, 2010. Earlier application is permitted.
Compliance Audits 2463 AU Section 801 Compliance Audits (Supersedes SAS No. 74.) Source: SAS No. 117. Effective for compliance audits for fiscal periods ending on or after June 15, 2010. Earlier application
G24 - SAS 70 Practices and Developments Todd Bishop
G24 - SAS 70 Practices and Developments Todd Bishop SAS No. 70 Practices & Developments Todd Bishop Senior Manager, PricewaterhouseCoopers LLP Agenda SAS 70 Background Information and Overview Common SAS
Questions from GAQC Conference Call The Impact of SAS 112 on Governmental Financial Statement Audits January 4, 2007
Questions from GAQC Conference Call The Impact of SAS 112 on Governmental Financial Statement Audits January 4, 2007 Preparing Financial Statements Q1. During a recent AICPA Webcast, a panelist indicated
Understanding changes to the Trust Services Principles for SOC 2 reporting
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Understanding changes to the Trust Services Principles for SOC 2 reporting
Service Organization Controls 3 Report
Service Organization Controls 3 Report Report on the Amazon Web Services System Relevant to Security For the Period April 1, 2013 March 31, 2014 Ernst & Young LLP Suite 1600 560 Mission Street San Francisco,
BASIS FOR CONCLUSIONS Canadian Standard on Assurance Engagements (CSAE) 3416, Reporting on Controls at a Service Organization
August 2010 BASIS FOR CONCLUSIONS Canadian Standard on Assurance Engagements (CSAE) 3416, Reporting on Controls at a Service Organization This Basis for Conclusions has been prepared by staff of the Auditing
CHANGYOU.COM LIMITED AUDIT COMMITTEE CHARTER
CHANGYOU.COM LIMITED AUDIT COMMITTEE CHARTER I. Composition of the Audit Committee: There will be a committee of the Board of Directors to be known as the Audit Committee. The Audit Committee will have
SRA International Managed Information Systems Internal Audit Report
SRA International Managed Information Systems Internal Audit Report Report #2014-03 June 18, 2014 Table of Contents Executive Summary... 3 Background Information... 4 Background... 4 Audit Objectives...
Management s Discussion and Analysis
Management s Discussion and Analysis 1473 AT Section 701 Management s Discussion and Analysis Source: SSAE No. 10. Effective when management s discussion and analysis is for a period ending on or after
PRACTICE NOTE 1013 ELECTRONIC COMMERCE - EFFECT ON THE AUDIT OF FINANCIAL STATEMENTS
PRACTICE NOTE 1013 ELECTRONIC COMMERCE - EFFECT ON THE AUDIT OF FINANCIAL STATEMENTS (Issued December 2003; revised September 2004 (name change)) PN 1013 (September 04) PN 1013 (December 03) Contents Paragraphs
Role is Broader and More Strategic
Internal Control Transformation IC s Role is Broader and More Strategic CACUBO Winter Workshop - 2013 Introduction Cindy Berg Director McGladrey LLP 201 N Harrison Street Davenport, Iowa 52801 cindy.berg@mcgladrey.com
Reports on Audited Financial Statements
Reports on Audited Financial Statements 2149 AU Section 508 * Reports on Audited Financial Statements (Supersedes sections 505, 509, 542, 545, and 546.) Source: SAS No. 58; SAS No. 64; SAS No. 79; SAS
Office of Inspector General
Audit Report OIG-04-017 Review of Assertions Included in the Interagency Crime and Drug Enforcement s Fiscal Year 2003 Annual Accounting of Drug Control Funds January 9, 2004 Office of Inspector General
SOC 2 Report Seattle, WA (SEF)
SOC 2 Report Seattle, WA (SEF) October 1, 2013 January 31, 2014 Independent Service Auditor s Report INTERNAP NETWORK SERVICES CORPORATION Company-Controlled Data Center Services Type 2 Report on Controls
Human Capital Management Application Development and Processing Services
Human Capital Management Application Development and Processing Service Organization Control (SOC) Report for the period of July 1, 2013 to June 30, 2014 This report, including the description of controls
Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions
PLAN ADVISORY Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions PLAN ADVISORY Table of Contents Introduction 3 Selecting and Monitoring Third-Party Service Providers 4 Quality
CPCAF Comfort Letter Procedures. Copyright 2005 by the American Institute of Certified Public Accountants, Inc., New York, New York.
Comfort Letter Procedures Relating to Capsule Financial Information Presented In a Registration Statement Prior to the Issuance of the Year-End Financial Statements This white paper is not authoritative
Independent Service Auditors Report
KPMG LLP Suite 1400 55 Second Street San Francisco, CA 94105 Independent Service Auditors Report The Board of Directors of GoDaddy.com, LLC: We have examined management's assertion that during the period
Guidance Statement GS 007 Audit Implications of the Use of Service Organisations for Investment Management Services
GS 007 (March 2008) Guidance Statement GS 007 Audit Implications of the Use of Service Organisations for Investment Management Services Issued by the Auditing and Assurance Standards Board Obtaining a
Casualty Actuarial Society. Continuing Education (CE) Policy
Casualty Actuarial Society Continuing Education (CE) Policy March 23, 2015 TABLE OF CONTENTS INTRODUCTION...1 A. CAS CONTINUING EDUCATION (CAS CE) POLICY...3 B. NATIONAL COMPLIANCE PROVISIONS...5 C. TRANSITION
ELIGIBILITY TO APPLY FOR OR RENEW THE PERMIT
OAB FORM 7 (Rev 4/05) OKLAHOMA ACCOUNTANCY BOARD (OAB) GUIDELINES FOR PERMITS TO PRACTICE PUBLIC ACCOUNTING/CONTINUING PROFESSIONAL EDUCATION Phone: 405/521-2397 E-mail: okaccybd@oab.state.ok.us Website:
Opening Balances Initial Audit Engagements, Including Reaudit Engagements
Opening Balances Initial Audit Engagements 469 AU-C Section 510 Opening Balances Initial Audit Engagements, Including Reaudit Engagements Source: SAS No. 122. Effective for audits of financial statements
SRI LANKA AUDITING PRACTICE STATEMENT 1013 ELECTRONIC COMMERCE EFFECT ON THE AUDIT OF FINANCIAL STATEMENTS
SRI LANKA AUDITING PRACTICE STATEMENT 1013 ELECTRONIC COMMERCE EFFECT ON THE AUDIT OF FINANCIAL STATEMENTS (This Statement is effective for all the audits commencing on or after 01 April 2010) CONTENTS
Reporting on Control Procedures at Outsourcing Entities
Auditing Guidance Statement AGS 1042 (July 2002) Reporting on Control Procedures at Outsourcing Entities Prepared by the Auditing & Assurance Standards Board of the Australian Accounting Research Foundation
INTERNATIONAL AUDITING PRACTICE STATEMENT 1013 ELECTRONIC COMMERCE EFFECT ON THE AUDIT OF FINANCIAL STATEMENTS
INTERNATIONAL PRACTICE STATEMENT 1013 ELECTRONIC COMMERCE EFFECT ON THE AUDIT OF FINANCIAL STATEMENTS (This Statement is effective) CONTENTS Paragraph Introduction... 1 5 Skills and Knowledge... 6 7 Knowledge
Association With Financial Statements
Association With Financial Statements 2139 AU Section 504 Association With Financial Statements (Supersedes SAS No. 1, sections 516, 517, and 518 and SAS No. 15, paragraphs 13 15.) [1] Source: SAS No.
SOC 3 for Security and Availability
SOC 3 for Security and Availability Independent Practioner s Trust Services Report For the Period October 1, 2014 through September 30, 2015 Independent SOC 3 Report for the Security and Availability Trust