Compliance

Does Your SOC Report Address Subservice Organizations Using the Carve Out or Inclusive Method?

By: Peter Clarke, Managing Consultant at A-LIGN A subservice organization is an entity that is used by the service organization to perform some of the services provided to customers (user entities).  An example of a common service provided by a subservice organization would be a company that offers their data center to a cloud provider (the service organization).  The service organization relies on processes and controls implemented at the subservice organization to meet the Control Objectives or Trust Services Principles of the SOC report. When a subservice organization is utilized by the service organization, there are two methods for reporting on the processes and controls at the subservice organization.  First, the processes and controls can be included as a part of the report.  This is the Inclusive method.  Second, the processes and controls can be excluded from the report.  This is the Carve Out method.  Each method requires that the service organization take steps to determine whether controls are in place and operating effectively to meet the needs of the end user (customer).

Read More

How to Differentiate Your Title Agency for Success in a Dynamic Market

By: Blaise Wabo, Senior Consultant at A-LIGN In 2012 the Consumer Financial Protection Bureau (CFPB) released a bulletin related to service providers’ oversight, in which they expect supervised banks and nonbanks (lenders) to oversee their business relationships with service providers in a manner that ensures compliance with Federal consumer financial…

Read More

School’s Back in Session – How to Stay Updated on Regulations

By: Sue Wells, Senior Consultant at A-LIGN One of the most important areas that clients of compliance professionals count on is that their third-party “expert” will stay current on relevant regulations. I’d like to share some of the ways compliance professionals keep current with regulations, which will also work for…

Read More

Understanding the Impact of Testing Exceptions in Type 2 SOC 1 and SOC 2 Reports

By: Ivan Reyes, Senior Consultant at A-LIGN Standards for Attestation Engagements No. 16 (“SSAE 16”) is an attestation standard whereby a service organization’s auditor issues an opinion on a service organization’s internal controls over financial reporting (ICFR). This is delivered in the form of a Service Organization Controls 1 (“SOC…

Read More

How to Determine a Quality Audit Report

By: Sara McLane, Senior Auditor at A-LIGN Service auditor reports are a great way for any service organization to showcase its compliance, to retain customers and to gain a competitive advantage. But how do you really know that your organization has just obtained a quality audit report? And why does…

Read More

4 Tips on How to Select a Quality Outsourced Vendor

By: Lori Crooks, Managing Consultant at A-LIGN As the popularity of outsourcing parts of information technology functions continue to grow, one common concern still remains: How do you know that you are partnering with a quality vendor? Below are a few tips that we have learned from our experience, in…

Read More

CSA Integrates Cloud Controls Matrix with SOC 2 Reports for Cloud Providers

By: Peter Clarke, Senior Consultant at A-LIGN The AICPA recently released an Illustrative Type 2 SOC 2 Report to assist auditors in reporting on the suitability of design and operating effectiveness on cloud security providers. The Cloud Security Alliance (CSA) Cloud Control Matrix (CCM) builds upon the AICPA’s Trust Services…

Read More

5 Steps to Succeed in Your Next Compliance Audit

By: Jay Anthony, President of Audit Liaison, PA Your organization has determined that there is a need for a compliance audit. But you have so many questions or don’t know where to start? A-LIGN has asked us to put together a short guide to help you decide the correct course…

Read More