What is Service Organizations

Many organizations outsource their business processes to service providers. The service providers must be audited by certified public accountants (CPA) to check the design and operation of their security procedures and internal controls (IC). These reports are called service organization control (SOC) reports. Through these reports, a CPA can express an opinion on the ICs of the services provider. SOC reports come in several different formats depending on the circumstance. As outsourcing becomes more popular and computer crimes increase, SOC reports will be more important. The objective of this chapter is to explain SOC reports, how they are compiled, and how they are used. Accordingly, this chapter gives a technical description of SOC reports so that professionals in the areas of accounting, auditing, and risk management can understand the purpose, application, and value of SOC reports. The authors conclude that as managers put more information on the cloud, SOC reports will fill an important need since they inform managers about risk management issues such as internal controls.