Service Organization Control Reports
|
|
|
- Rafe Wilcox
- 9 years ago
- Views:
Transcription
1 SAS 70 ENDS EXIT TO SSAE 16 Service Organization Control Reports What Did We Learn from Year One?
2 Agenda Definitions Service Organization Reports What are they? Year One Experiences SSAE 16 Year One Experiences SOC 2 Reading a Report Questions / Discussion
3 What are Service Organizations? Service Organization provider of services that may impact a risk to a user s financial reporting, or that pose a business or compliance risk Services such as: Cloud computing (SaaS, IaaS, PaaS) Managed security Boutique AR / AP / Tax Outsourcing Financial services customer accounting Customer support Sales force automation Health care claims management and processing Enterprise IT outsourcing
4 Common Terms Service auditor a CPA who examines and reports on controls at a service organization Users typically considered clients of service organization May need assurance regarding controls over ICFR, security, availability, processing integrity, confidentiality or privacy User Auditor a CPA who performs a audit on the users financial statements Needs assurance regarding the controls in place at the service organization that impact user financial statements (ICFR)
5 Service Organization Control Reports
6 Changes: SAS vs. SSAE June 15, 2011 sunset date for SAS 70 Attest standard (Assertion), not an audit standard (GAAP) Consistency with international standards and existing attestation standards Increased focus on service organizations with services relevant to a user organizations internal control over financial reporting (ICFR) Some SAS 70 reports will move to SOC 2 or SOC 3 reports By the way No such thing as a SAS 70 or SSAE 16 certification
7 Service Organization Control Reports Purpose SOC 1 SOC 2 SOC 3 Report on controls relevant to user entities ICFR 1 Report on controls related to compliance and operations Use of Report Restricted 2 Restricted 3 General Report Detail AICPA Interpretive Guidance & Reporting Vehicle Includes Testing Detail Type 1 or Type 2 SSAE 16, AICPA Guide 1 Internal Control Over Financial Reporting 2 Service Organization Management, Users, Users Auditor 3 Service Organization Management, Users, Knowledgeable Parties Includes Testing Detail Type 1 or Type 2 AT 101, AICPA Trust Services Principles, AICPA Guide Report on controls related to compliance and operations No Testing Detail AT 101, AICPA Trust Services Principles TSP 100
8 Type 1 and Type 2 Reports Type 1 Reports on fairness of presentation of management s description of the service organization s system The suitability of design of controls Unlikely to provide sufficient information to assess risks Provides an understanding system and controls May be useful when: Organization is new Recently made significant changes Other reason insufficient time or history to perform Type 2
9 Type 1 and Type 2 Reports Type 2 Same as Type 1 plus Service auditor opinion on operating effectiveness A detailed description of service auditor s tests of controls and results Reporting on compliance with selected TSPs (SOC 2) Most frequently requested type of report
10 SSAE 16 Year One Experiences and Key Issues
11 Which Report Do I Use? ICFR SOC 1 (SSAE 16) Limited Use / Trust Principles SOC 2 General Use / Trust Principles SOC 3 Discussion Cloud Services Data Centers Electronic Medical Record SaaS TPAs Driver Who is the intended user?
12 Scoping Included/excluded services Services that impact your client s financial reporting Key third parties (sub-service organizations) Identify all relevant 3 rd party service organizations Existence and use of their SSAE 16/SOC 2 Report Commitments from 3 rd party relative to carve out or inclusive method Treatment of subservice organizations Included (inclusive method) Excluded (carve-out method)
13 Key Issues: Management Assertion - New A Management Assertion will be included in or attached to the SSAE 16 report States*: System fairly represented System suitably designed and implemented The related controls activities were suitably designed to achieve the stated control objectives That the control activities are operating effectively (Type 2 only) *The auditor opinion attests to these statements. Type 1 specified date/type 2 throughout the period
14 Key Issues: Management Assertion The report will reference that management is responsible for: Preparing the system description Providing the stated services Specifying the control objectives Identifying the risks Selecting and stating the criteria for their assertion (e.g. monitoring activities) Designing, implementing and documenting controls that are suitably designed and operating effectively
15 Key Issues: Management Assertion Auditor s Opinion remains in the role of providing assurance regarding management s assertions (same but more emphasis) Auditor is not the entity responsible for the communication (same but more emphasis) Subservice organizations must provide a similar assertion when the inclusive method is used
16 Management Assertion - Issues Boilerplate with edits for inclusive / exclusive treatment of subservice organizations Management s basis for assertion Sufficiency of current monitoring processes Need for direct testing of controls not sufficiently monitored
17 Management Assertion - Issues Audit Firm Formats Signed Unsigned Dated What date? No Date
18 Key Issues: System Description SAS 70 was a narrative description of controls SSAE 16 requires a description of the system Infrastructure Software People Procedures Data
19 Key Issues: System Description Components common to existing Descriptions of Controls Organizational Overview Types of Services covered Period covered Control objectives and related control activities Complementary user controls
20 Key Issues: System Description Other relevant aspects of the organization s: Control environment Risk assessment process Information and communication systems Control activities and monitoring controls
21 Key Issues: System Description Additional elements for the Description of the System Classes of transactions and details on related procedures and accounting records The capturing and addressing of significant events other than transactions Report preparation processes Changes to the system during the period (Type 2)
22 Key Issues: System Description Identify excluded subservice organizations For inclusive subservice organizations, add Related system description Related control objectives Related control activities
23 Key Issues: Supporting Control Design Management should: Identify the risks that threaten the achievement of the stated services Identify the risks that threaten the achievement of the stated control objectives Evaluate whether the identified controls sufficiently address the risks to achieving the control objectives Risks to Services Risks to Control Objectives Control Objectives Control Activities
24 Design of Controls: Based on Risk Risk Assessment Supporting Control Design Services Provided Assessment of risks to services leads to: Control Objectives Assessment of risk to control objective leads to: Control Activities
25 Key Issues: Design of Control Objectives Identification of Service Process Areas Completeness of objectives to address risks Types of Control Objectives Entity Program Development / Change Management General IT Business Process Use existing frameworks / SOX efforts / compliance requirements
26 Key Issues: Design of Control Activities Specificity of activities Controls vs. processes Specific Testable Identifying supporting documentation Relating user considerations Management assertion considerations
27 Other Key Issues Service auditor use of internal audit Reliance on / must disclose Direct use / no disclosure Certain aspects of opinion apply to entire period rather than a point in time Narrative Control design Control implementation
28 SOC 2 Year One Experiences and Key Issues
29 SOC 2 Reporting TSP Criteria Security: The system is protected against unauthorized access (physical and logical) Availability: The system is available for operation and use as committed or agreed Processing Integrity of the system: System processing is complete, accurate, timely and authorized Confidentiality of information processed: Information designated as confidential is protected as committed or agreed Privacy of information processed: Personal information is collected, used retained, disclosed and disposed of in conformity with the commitments in the entity's privacy notice
30 Unique SOC 2 Key Issues Most Issues the same as SSAE 16 Identification of applicable Trust Service Principles / Criteria Narrative Discussion of TSP at included and excluded subservice organizations Identification of compliance of relevant subservice organizations with key TSP criteria Report Display of control activities supporting selected TSP criteria
31 Reporting to Multiple Audiences Multiple reports scenarios SOC 1 and SOC 2 Services impacting ICFR of user and other services with trust services principles concerns SOC 2 and SOC 3 Services not impacting ICFR and need to use beyond current users such as marketing to prospects SOC 1 and SOC 3 Services impacting ICFR of user and other services with trust services principles concerns or marketing needs Note must be separate reports
32 Reading a SOC Report
33 Report Components Opinion Qualified (Modified) Modifications are specific Not pass/fail User must assess impact of modification References to subservice organizations Inclusive or Exclusive Assertion Subservice Organizations Inclusive or Exclusive
34 Report Components Narrative Organization overview Scope / related services not included as compared to services obtained by user Sufficiency of description / controls for services obtained by user User Considerations Assess if you have implemented user considerations Consider sufficiency and applicability to services utilized
35 Report Components Control Objectives Organization / scope of objectives Sufficiency of service process areas compared to services utilized Completeness for your purpose Control Activities Completeness Description of testing Results / exceptions Impact of exceptions on your services
36 Report Components Other Information Changes between end of period and report date Management responses to opinion modifications or testing exceptions Other unaudited information relevant to user Glossary BCP / DR executive overview Organizational information
37 Questions / Discussion
38 Thank you for attending. Learn more at bkd.com Rod Walsh Director
The Changing SAS 70 Landscape Dan Hirstein Director Rebecca Goodpasture Senior Manager Deloitte & Touche LLP January 13, 2011
The Changing SAS 70 Landscape Dan Hirstein Director Rebecca Goodpasture Senior Manager Deloitte & Touche LLP January 13, 2011 Table of Contents A Short History of SAS 70 Overview of SSAE 16 and ISAE 3402
Goodbye, SAS 70! Hello, SSAE 16!
Goodbye, SAS 70! Hello, SSAE 16! A Session to Provide Insight on the New Standard and What Service Providers and End-Users Need to Know January 3, 2012 Agenda Introduction Background on what was SAS 70
Service Organization Control (SOC) Reports Focus on SOC 2 Reporting Standard
Information Systems Audit and Controls Association Service Organization Control (SOC) Reports Focus on SOC 2 Reporting Standard February 4, 2014 Tom Haberman, Principal, Deloitte & Touche LLP Reema Singh,
Understanding SOC Reports for Effective Vendor Management. Jason T. Clinton January 26, 2016
Understanding SOC Reports for Effective Vendor Management Jason T. Clinton January 26, 2016 MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2012 Wolf & Company, P.C. Before we
Shared Service System Audits: What User Management and Auditors Need to Know
Shared Service System Audits: What User Management and Auditors Need to Know JFMIP May 2014 Presented by: Robert Dacey GAO Session Objectives Properly using SSAE 16 service organization audit reports Revisions
SECTION I INDEPENDENT SERVICE AUDITOR S REPORT
SOC2 Security Report on Controls Supporting DriveSavers Services Independent Service Auditor s Report on Design of Controls Placed in Operation and Tests of Operational Effectiveness Relevant to Security
Information for Management of a Service Organization
Information for Management of a Service Organization Copyright 2011 American Institute of Certified Public Accountants, Inc. New York, NY 10036-8775 All rights reserved. For information about the procedure
SSAE 16 for Transportation & Logistics Companies. Chris Kradjan Kim Koch
SSAE 16 for Transportation & Logistics Companies Chris Kradjan Kim Koch 1 The material appearing in this presentation is for informational purposes only and should not be construed as advice of any kind,
SERVICE ORGANIZATION CONTROL REPORTS SM. Formerly SAS 70 Reports
SERVICE ORGANIZATION CONTROL REPORTS SM Formerly SAS 70 Reports SAS No. 70, Service Organizations Standard for reporting on a service organization s controls affecting user entities financial statements
Service Organization Controls. Managing Risks by Obtaining a Service Auditor s Report
Service Organization Controls Managing Risks by Obtaining a Service Auditor s Report Contributing Authors Audrey Katcher, CPA/CITP, Partner at RubinBrown, LLP Janis Parthun, CPA/CITP, Sr. Technical Manager
Farewell to SAS 70. What you need to know about the New Standard for Service Organization Reporting
Farewell to SAS 70 What you need to know about the New Standard for Service Organization Reporting ADVISORY rights reserved. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative
Effectively using SOC 1, SOC 2, and SOC 3 reports for increased assurance over outsourced operations. kpmg.com
Effectively using SOC 1, SOC 2, and SOC 3 reports for increased assurance over outsourced operations kpmg.com b Section or Brochure name Effectively using SOC 1, SOC 2, and SOC 3 reports for increased
Service Organization Control (SOC) Reports
Service Organization Control (SOC) Reports Transitioning from SAS 70 to SSAE 16 Deloitte & Touche LLP Agenda Overview SAS 70/SSAE 16 Historical Perspective The New Framework Under SSAE 16 (SOC 1) Impact
SSAE 16 and ISAE 3402: Preparing for New Service Company Control Standards Mastering Requirements Governing Your Next Controls Report
Presenting a live 110 minute teleconference with interactive Q&A SSAE 16 and ISAE 3402: Preparing for New Service Company Control Standards Mastering Requirements Governing Your Next Controls Report WEDNESDAY,
Service Organization Control (SOC) reports What are they?
Service Organization Control (SOC) reports What are they? Jeff Cook, CPA, CITP, CIPT, CISA June 2015 Introduction Service Organization Control (SOC) reports are on the rise in the IT assurance and compliance
CSA Position Paper on AICPA Service Organization Control Reports
CSA Position Paper on AICPA Service Organization Control Reports February 2013 2013, Cloud Security Alliance. All rights reserved. You may download, store, display on your computer, view, print, and link
SAS No. 70, Service Organizations
SAS No. 70, Service Organizations A standard for reporting on a service organization s controls affecting user entities' financial statements. Only for use by service organization management, existing
SSAE 16 Everything You Wanted To Know But Are Afraid To Ask. Kurt Hagerman CISA, CISSP, QSA Managing Director, Coalfire December 8, 2011
SSAE 16 Everything You Wanted To Know But Are Afraid To Ask Kurt Hagerman CISA, CISSP, QSA Managing Director, Coalfire December 8, 2011 1 Agenda SAS 70 Misunderstood and Overused o Why the change? SSAE
Frequently asked questions: SOC 2 and 3
1. Is the licensing requirement for a SOC 2 or 3 different than for a SOC 1? SOC reports are attestation reports issued in accordance with AICPA standards. Therefore, licensing requirements are the same
Vendor Management Best Practices
23 rd Annual and One Day Seminar Vendor Management Best Practices Catherine Bruder CPA, CITP, CISA, CISM, CTGA Michigan Texas Florida Insight. Oversight. Foresight. SM Doeren Mayhew Bruder 1 $100 billion
Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions
Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions Plan Advisory The AICPA EBPAQC is a firm-based, volunteer membership center created with the goal of promoting quality employee
SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS
SOC on Amazon Web Services (AWS) What You Need To Know Understanding the regulatory roadmap for SOC on AWS Jeff Cook November 2015 Summary Service Organization Control (SOC) reports (formerly SAS 70 or
SOC Readiness Assessments. SOC Report - Type 1. SOC Report - Type 2. Building Trust and Confidence in Third-Party Relationships
Building Trust and Confidence in Third-Party Relationships Today s businesses rely heavily on outsourcing certain business tasks or functions to service organizations, even those that are core to their
FAQs New Service Organization Standards and Implementation Guidance
FAQs New Service Organization Standards and Implementation Guidance During the past two years several significant changes have occurred in audit and attest standards for reporting on controls at service
Here comes SSAE 16 SAS 70 EVOLUTION: How will the new standard affect my business? How do I prepare to meet the new requirements?
SAS 70 EVOLUTION: Here comes SSAE 16 PLANNING FOR THE NEW SERVICE ORGANIZATION REPORTING STANDARDS The prevalence of SAS 70 audits has grown dramatically since the standards issuance in April of 1992.
Ayla Networks, Inc. SOC 3 SysTrust 2015
Ayla Networks, Inc. SOC 3 SysTrust 2015 SOC 3 SYSTRUST FOR SERVICE ORGANIZATIONS REPORT July 1, 2015 To December 31, 2015 Table of Contents SECTION 1 INDEPENDENT SERVICE AUDITOR S REPORT... 2 SECTION 2
SECURITY AND EXTERNAL SERVICE PROVIDERS
SECURITY AND EXTERNAL SERVICE PROVIDERS How to ensure regulatory compliance and manage risks with Service Organization Control (SOC) Reports Jorge Rey, CISA, CISM, CGEIT Director, Information Security
Documentation of Use of a Type 2 Service Auditor s Report In an Audit of an Employee Benefit Plan s Financial Statements
Documentation of Use of a Type 2 Service Auditor s Report In an Audit of an Employee Benefit Plan s Financial Statements PLAN NAME: PLAN YEAR END: CLIENT NUMBER: SCOPE OF PLAN AUDIT: LIMITED FULL Note:
Understanding ISO 27018 and Preparing for the Modern Era of Cloud Security
Understanding ISO 27018 and Preparing for the Modern Era of Cloud Security Presented by Microsoft and Foley Hoag LLP s Privacy and Data Security Practice Group May 14, 2015 Proposal or event name (optional)
Service Organization Controls. Managing Risks by Obtaining a Service Auditor s Report
Service Organization Controls Managing Risks by Obtaining a Service Auditor s Report Contributing Authors Audrey Katcher, CPA, CITP, Partner at RubinBrown, LLP Janis Parthun, CPA, CITP, Sr. Technical Manager
How To Be A Successful Compliance Officer
: A Pragmatic Approach to SOC2 and PCI compliance The Cadence Group is a professional services firm specializing in financial and IT compliance and risk management services. Our value proposition includes:
SSAE 16 SOC 1 Type 2
SSAE 16 SOC 1 Type 2 Independent Service Auditor s Report on Management s Description of a Service Organization s System and the Suitability of the Design and Operating Effectiveness of Controls September
Reporting on Controls at a Service Organization
Reporting on Controls at a Service Organization 1529 AT Section 801 Reporting on Controls at a Service Organization (Supersedes the guidance for service auditors in Statement on Auditing Standards No.
SSAE 16 & SAS 70 A Primer on Changes to Service Organization Audit Standards
A Member of OneBeacon Insurance Group SSAE 16 & SAS 70 A Primer on Changes to Service Organization Audit Standards Author: Jack Fletcher, Risk Control Technology Specialist Published: November 2014 Executive
Webtrends Inc. Service Organization Controls (SOC) 3 SM Report on the SaaS Solutions Services System Relevant to Security
Webtrends Inc. Service Organization Controls (SOC) 3 SM Report on the SaaS Solutions Services System Relevant to Security For the Period January 1, 2015 through June 30, 2015 SOC 3 SM SOC 3 is a service
G24: Audits of Controls at a Service Organization: New Standards SSAE 16 and ISAE 3402 Duff Donnelly and Jeffrey Spivack, Grant Thornton LLP
G24: Audits of Controls at a Service Organization: New Standards SSAE 16 and ISAE 3402 Duff Donnelly and Jeffrey Spivack, Grant Thornton LLP Audits of controls at a service organization Roadmap to the
Internal Controls over Financial Reporting. Integrating in Business Processes & Key Lessons learned
Internal Controls over Financial Reporting Integrating in Business Processes & Key Lessons learned Introduction Stephen McIntyre, CA, CPA (Illinois) Senior Manager at Ernst & Young in the Risk Advisory
3.B METHODOLOGY SERVICE PROVIDER
3.B METHODOLOGY SERVICE PROVIDER Approximately four years ago, the American Institute of Certified Public Accountants (AICPA) issued Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting
www.pwc.com Third Party Risk Management 12 April 2012
www.pwc.com Third Party Risk Management 12 April 2012 Agenda 1. Introductions 2. Drivers of Increased Focus on Third Parties 3. Governance 4. Third Party Risks and Scope 5. Third Party Risk Profiling 6.
Orchestrating the New Paradigm Cloud Assurance
Orchestrating the New Paradigm Cloud Assurance Amsterdam 17 January 2012 John Hermans - Partner Current business challenges versus traditional IT Organizations are challenged with: Traditional IT seems
Cloud Computing An Auditor s Perspective
Cloud Computing An Auditor s Perspective Sailesh Gadia, CPA, CISA, CIPP [email protected] December 9, 2010 Discussion Agenda Introduction to cloud computing Types of cloud services Benefits, challenges,
Service Organizations and the Internal Audit function. 2015 conference Institute of Internal Auditors in Israel
Service Organizations and the Internal Audit function 2015 conference Institute of Internal Auditors in Israel Proprietary This work product/document is intended solely for the information and use of the
A Flexible and Comprehensive Approach to a Cloud Compliance Program
A Flexible and Comprehensive Approach to a Cloud Compliance Program Stuart Aston Microsoft UK Session ID: SPO-201 Session Classification: General Interest Compliance in the cloud Transparency Responsibility
COSO Internal Control Integrated Framework (2013)
COSO Internal Control Integrated Framework (2013) The Committee of Sponsoring Organizations of the Treadway Commission (COSO) released its updated Internal Control Integrated Framework (2013 Framework)
Service Organization Control (SOC 3) Report on a Description of the Data Center Colocation System Relevant to Security and Availability
15301 Dallas Parkway, Suite 960, Addison, TX 75001 MAIN 214 545 3965 FAX 214 545 3966 www.bkmsh.com Service Organization Control (SOC 3) Report on a Description of the Data Center Colocation System Relevant
Update on AICPA Assurance Services Executive Committee Activities
Update on AICPA Assurance Services Executive Committee Activities Amy Pawlicki Director Business Reporting, Assurance & Advisory Services and XBRL AICPA Agenda ASEC overview Summary of work streams by
Hans Bos Microsoft Nederland. [email protected]
Hans Bos Microsoft Nederland Email: Twitter: [email protected] @hansbos Microsoft s Cloud Environment Consumer and Small Business Services Software as a Service (SaaS) Enterprise Services Third-party
INTERNATIONAL STANDARD ON ASSURANCE ENGAGEMENTS (ISAE) 3402 ASSURANCE REPORTS ON CONTROLS AT A SERVICE ORGANIZATION
INTERNATIONAL STANDARD ON ASSURANCE ENGAGEMENTS (ISAE) 3402 ASSURANCE REPORTS ON CONTROLS AT A SERVICE ORGANIZATION (Effective for service auditors assurance reports covering periods ending on or after
Securing Oracle E-Business Suite in the Cloud
Securing Oracle E-Business Suite in the Cloud November 18, 2015 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation Agenda The
Microsoft s Compliance Framework for Online Services
Microsoft s Compliance Framework for Online Services Online Services Security and Compliance Executive summary Contents Executive summary 1 The changing landscape for online services compliance 4 How Microsoft
How To Audit Cloud Computing
Assessing the Audit Impact of Cloud Computing kpmg.com 1 Assessing the Audit Impact of Cloud Computing Cloud Computing Cloud computing is becoming an important IT strategy for entities that need varying
IAASB Main Agenda (June 2010) Agenda Item. April 28, 2009
Agenda Item 8-B Statement of Position 09-1 April 28, 2009 Performing Agreed-Upon Procedures Engagements That Address the Completeness, Accuracy, or Consistency of XBRL-Tagged Data Issued Under the Authority
Asset Manager Guide to SAS 70. Issue Date: October 7, 2007. Asset
Asset Manager Guide to SAS 70 Issue Date: October 7, 2007 Asset Management Group A s s e t M a n a g e r G u i d e SAS 70 Table of Contents Executive Summary...3 Overview and Current Landscape...3 Service
BASIS FOR CONCLUSIONS Canadian Standard on Assurance Engagements (CSAE) 3416, Reporting on Controls at a Service Organization
August 2010 BASIS FOR CONCLUSIONS Canadian Standard on Assurance Engagements (CSAE) 3416, Reporting on Controls at a Service Organization This Basis for Conclusions has been prepared by staff of the Auditing
Understanding changes to the Trust Services Principles for SOC 2 reporting
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. Understanding changes to the Trust Services Principles for SOC 2 reporting
OFFICE OF AUDITS & ADVISORY SERVICES CLOUD COMPUTING AUDIT FINAL REPORT
County of San Diego Auditor and Controller OFFICE OF AUDITS & ADVISORY SERVICES CLOUD COMPUTING AUDIT FINAL REPORT Chief of Audits: Juan R. Perez Audit Manager: Lynne Prizzia, CISA, CRISC Senior Auditor:
Agreed-Upon Procedures Engagements
Agreed-Upon Procedures Engagements 1323 AT Section 201 Agreed-Upon Procedures Engagements Source: SSAE No. 10; SSAE No. 11. Effective when the subject matter or assertion is as of or for a period ending
ASSESSING VENDORS USING THE NIST CYBERSECURITY FRAMEWORK
ASSESSING VENDORS USING THE NIST CYBERSECURITY FRAMEWORK Enterprise Risk Management Vendor Management Business Continuity IT GRC Internal Audit Regulatory Compliance Manager Dan Banning Director of Marketing
COSO 2013 Internal Control Integrated Framework FRED J. PETERSON, PARTNER MOSS ADAMS LLP
COSO 2013 Internal Control Integrated Framework FRED J. PETERSON, PARTNER MOSS ADAMS LLP Disclaimer The material appearing in this presentation is for informational purposes only and should not be construed
Citation for published version (APA): Berthing, H. H. (2014). Vision for IT Audit 2020. Abstract from Nordic ISACA Conference 2014, Oslo, Norway.
Aalborg Universitet Vision for IT Audit 2020 Berthing, Hans Henrik Aabenhus Publication date: 2014 Document Version Early version, also known as pre-print Link to publication from Aalborg University Citation
Cybersecurity and the AICPA Cybersecurity Attestation Project
Cybersecurity and the AICPA Cybersecurity Attestation Project Chris Halterman Executive Director EY Chair AICPA Trust Information Integrity Task Force 2 October 2015 Increasing awareness of cybersecurity
Third party assurance services
TECHNOLOGY RISK SERVICES Third party assurance services Delivering assurance over your service providers The current third party service provider environment Corporate UK has been transformed in recent
Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions
PLAN ADVISORY Effective Monitoring of Outsourced Plan Recordkeeping and Reporting Functions PLAN ADVISORY Table of Contents Introduction 3 Selecting and Monitoring Third-Party Service Providers 4 Quality
SOC 3 for Security and Availability
SOC 3 for Security and Availability Independent Practioner s Trust Services Report For the Period October 1, 2013 through September 30, 2014 Independent SOC 3 Report for the Security and Availability Trust
Internal Controls Best Practices By Jennifer Downs, CPA Benefit Audit Group, LLC
Internal Controls Best Practices By Jennifer Downs, CPA Benefit Audit Group, LLC Internal control consists of: Entity level controls these controls relate to the overall control environment and can potentially
2. Auditing. 2.1. Objective and Structure. 2.2. What Is Auditing?
- 4-2. Auditing 2.1. Objective and Structure The objective of this chapter is to introduce the background information on auditing. In section 2.2, definitions of essential terms as well as main objectives
Cloud Security and Managing Use Risks
Carl F. Allen, CISM, CRISC, MBA Director, Information Systems Security Intermountain Healthcare Regulatory Compliance External Audit Legal and ediscovery Information Security Architecture Models Access
How mature is the internal control framework at your service organisation? ISAE 3402 and SSAE 16: Reinforcing confidence through demonstration of
How mature is the internal control framework at your service organisation? ISAE 3402 and SSAE 16: Reinforcing confidence through demonstration of effective controls ISAE 3402 and SSAE 16 defined Overview
Stone Vault, LLC SOC 1 (SSAE NO. 16) TYPE 1 REPORT ON CONTROLS PLACED IN OPERATION FOR TAX RETURN AND FINANCIAL STATEMENT PORTAL SERVICES
SOC 1 (SSAE NO. 16) TYPE 1 REPORT ON CONTROLS PLACED IN OPERATION FOR TAX RETURN AND FINANCIAL STATEMENT PORTAL SERVICES Stone Vault, LLC JANUARY 31, 2013 STONE VAULT, LLC Table of Contents SECTION 1:
NSW Government. Data Centre & Cloud Readiness Assessment Services Standard. v1.0. June 2015
NSW Government Data Centre & Cloud Readiness Assessment Services Standard v1.0 June 2015 ICT Services Office of Finance & Services McKell Building 2-24 Rawson Place SYDNEY NSW 2000 [email protected]
Audit, Review, Compilation, and Preparation of Financial Statements
Audit, Review, Compilation, and Preparation of Financial Statements DISCLAIMER: This publication has not been approved, disapproved or otherwise acted upon by any senior technical committees of, and does