SOC

System and Organization Controls (SOC) are a critical set of standards, audits, and reports for organizations of all types. Bean Counter provides SOC services to both service providers and companies in the food, beverage, and agro-commodity industries that rely on IT services. We help ensure uninterrupted and secure service delivery to your clients and consumers.

SOC 2 provide assurance over a service company's controls related to one or more of the five "trust services criteria": security, availability, processing integrity, confidentiality, and privacy. Unlike SOC 1, which focuses solely on financial reporting, SOC 2 is broader and can cover any or all of these criteria. Clients need assurance that the service organization maintains appropriate controls to protect their data and systems. This is particularly crucial for organizations handling sensitive information.

• SOC 2 Type 1: A Type 1 report attests to the design of controls as of a specific date

• SOC 2 Type 2: A Type 2 report attests to the operating effectiveness of controls over a period of time (typically 6-12 months). It provides evidence that the controls are working as intended.

SOC 2 reports are essential for organizations handling sensitive data and play a significant role in vendor risk management. Choosing the right trust services criteria and understanding the difference between Type 1 and Type 2 reports is crucial for both the service organization and its clients.

SOC 1 concerns service companies, often providing IT services, that handle or contribute to their client's financial reporting. This is known as internal controls over financial reporting (ICFR). The client requires assurance that that service company can accurately and consistently provide financial information. Therefore, the service company requires a system of controls that are defined, adequate, and tested for their operational effectiveness.

• SOC 1 Type 1 - A report on the design of the service company's controls

• SOC 1 Type 2 - A report on the operational effectiveness of the service company's controls, after they have been tested

SOC 1 reports are essential for user entities relying on service organizations for functions that impact their financial reporting. Understanding the difference between Type 1 and Type 2 reports, and ensuring the service organization's controls are adequate and operating effectively, is crucial for maintaining accurate financial statements and complying with relevant regulations. For service organizations, obtaining a SOC 1 report can demonstrate their commitment to strong internal controls and provide a competitive advantage.

SOC 1

SOC 2

Whether you're a service organization needing robust controls to assure clients of your trustworthiness, or a user entity relying on IT services to deliver food, beverages, or agri-commodities, Bean Counter PAS can help you navigate your SOC requirements and reporting.

• Requirements planning

• SOC reports evaluation

• Controls integration

• Controls design

• Type 1 reporting - documentation of control design (SOC 1 and SOC 2)

• Type 2 reporting - controls testing and reporting - (SOC 1 and SOC 2)

For user entities

For service organizations