HWNS LLC

HWNS LLCHWNS LLCHWNS LLC
  • Home
  • SOC Report Types
  • Checklist
  • SOC Reports
    • SOC 1
    • SOC 2
    • SOC 3
  • Contact Us
  • More
    • Home
    • SOC Report Types
    • Checklist
    • SOC Reports
      • SOC 1
      • SOC 2
      • SOC 3
    • Contact Us

HWNS LLC

HWNS LLCHWNS LLCHWNS LLC
  • Home
  • SOC Report Types
  • Checklist
  • SOC Reports
    • SOC 1
    • SOC 2
    • SOC 3
  • Contact Us

SOC 1

 A SOC 1 Report (Service and Organization Controls Report) is a report on Controls at a Service Organization which are relevant to user entities’ internal control over financial reporting. The SOC 1 Report is what you would have previously considered to be the standard SAS 70 (or SSAE 16), complete with a Type I and Type II reports, but falls under the SSAE 18 guidance (as of May 1, 2017).  


Below is a history of key changes made to the audit standard over time to enhance the overall audit and final report.

Differences between SAS 70 and SSAE 16:

1. Management of the Service Organization will be required to provide the service auditor with a written assertion about the following, when performing either a Type I or Type II engagement, which the service auditor will then attest to:   a. The fairness of the presentation of the description of the service organization’s system;   b. The suitability of the design of the controls to achieve the related control objectives stated in the description; and   c. The operating effectiveness of those controls to achieve the related control objectives stated in the description (Type II Only)
2. During the process of understanding the service organization’s system, the Service Auditor would be required to obtain information that would identify risks that the description of the service organization’s system is not fairly presented or that the control objectives stated in the description were not achieved due to intentional actions by service organization personnel.

SSAE 18 adds an additional set of requirements to further enhance SSAE 16 standard:

1. Requires the inclusion of a Complementary Subservice Organization Controls section (similar to what is currently required for SOC 2).

2. Requires the performance of a detailed Risk Assessment based on the control objectives defined in the report.


Remember: The SSAE 18 and the SSAE 16 both are still considered to be a SOC 1 Report.  The latest changes are meant to give the end user a clearer picture of their vendor’s subservice organizations and the responsibilities of the end user as well (Complementary User Entity Controls), which, will help to provide an all-around higher level of assurance and understanding to all involved.


SOC 2 and SOC 3 – Additional Reporting Options In addition to the SOC 1 report which is restricted to controls relevant to an audit of a user entity’s financial statements, the SOC 2 and SOC 3 reports have been created to address controls relevant to operations and compliance.

  • SOC 2 Report – Trust Services Principles – The Service Organization Control (SOC) 2 Report will be performed in accordance with AT 101 and based upon the Trust Services Principles, with the ability to test and report on the design (Type I) and operating (Type II) effectiveness of a service organization’s controls (just like SOC 1 / SSAE 18). 
  • SOC 3 Report – WebTrust and SysTrust – The SOC 3 Report is also based upon the Trust Service Principles and performed under AT101, the difference being that a SOC 3 Report is permitted to be freely distributed (general use) and only reports on if the entity has achieved the Trust Services criteria or not (no description of tests and results or opinion on description of the system) 

The SOC 3 Report, just like the SOC 2, is based upon the Trust Service Principle and performed under AT101, the difference being that a SOC 3 Report can be freely distributed (general use) and only reports on if the entity has achieved the Trust Services criteria or not (no description of tests and results or opinion on description of the system). The lack of a detailed report requires that a SOC 3 be performed as a Type II, unlike SOC 1 and SOC 2 where there is a Type I option, SOC 3 reports can be issued on one or multiple Trust Services principles (security, availability, processing integrity, confidentiality and privacy) and allow the organization to place a seal on their website upon successful completion.


The Trust Service Principles were designed with a focus on e-commerce systems due to the amount of private/confidential/financial information that flows across the internet daily. When a customer processes a transaction (online retailer), builds a business on your service (SaaS providers), or submits private information, they want to know best practices are being followed by the company to guard against security leaks, lost sales, and damaged data. The most common reports based upon the trust principles are referred to as WebTrust and SysTrust.


The SysTrust review encompasses a combination of the following principles:

  • Security: The system is protected against unauthorized access (both physical and logical).
  • Availability: The system is available for operation and use as committed or agreed.
  • Processing Integrity: System processing is complete, accurate, timely, and authorized.
  • Confidentiality: Information designated as confidential IS protected as committed or agreed.

The WebTrust certification can fall into the following four categories:

  • WebTrust: The scope of the engagement includes any combination of the trust principles and criteria.
  • WebTrust Online Privacy: The scope of the engagement is based upon the online privacy principle and criteria.
  • WebTrust Consumer Protection: The scope of the engagement is based upon the processing integrity and relevant online privacy principles and criteria.
  • WebTrust for Certification Authorities: The scope of the engagement is based upon specific principles and related criteria unique to certification authorities.

Copyright © 2018 HWNS LLC - All Rights Reserved.

  • SOC Report Types