An agreed-upon procedures (AUP) engagement is an attestation engagement where a CPA or CPA firm performs specific procedures on the subject matter and issues a report of findings. The subject matter can be financial or nonfinancial. The practitioner and the client agree on the procedures to be performed. The authoritative guidance that […]
Whether your 401(k) or employee benefit plan recently hit the audit requirement or you are looking for a new 401(k) or employee benefit plan auditor, there many resources to consider and steps to take in order to ensure that your 401(k) or employee benefit plan audit is completed efficiently and in […]
In general, organizations that receive SOC 1 or SOC 2 reports must demonstrate that they have a vendor management program and associated controls in place to address the risks associated with vendors and business partners. One of the common questions that arises during SOC audits is how to identify the “critical” […]
There are several resources that CPA firms can use to develop their sampling methodology for SOC 1 and SOC 2 audits. These included: The AICPA’s SOC 1 and 2 Audit Guides The AICPA’s Audit Sampling Guide AU-C Section 530: Audit Sampling It is important to note that the AICPA does not […]
A popular belief for many years was that Linux systems did not require anti-virus or anti-malware. Although Linux is perceived to be more secure than other desktop operating systems, there are still malware and viruses that can affect Linux computers. In fact, the amount of Linux malware has been steadily growing […]
Background The ERISA Section 103(a)(3)(C) Audit is one of the more common types of audits performed over a 401(k) or employee benefit plan. As part of the audit, management of the 401(k) or employee benefit plan must determine if the ERISA Section 103(a)(3)(C) audit is permissible by obtaining and inspecting a […]
Companies often align their controls with specific processes or frameworks such as the International Organization for Standardization (ISO) or the National Institute of Standards and Technology (NIST). When this occurs and the company receives a SOC 2 report, the service auditor should consider if: The process or framework used is required […]
Generally, SOC 1 and SOC 2 reports include a description of complementary subservice organization controls (CSOCs) and complementary user entity controls (CUECs), which are defined as follows in the AICPA SOC 2 Audit Guide: CSOCs Controls that service organization management assumed, in the design of the service organization’s system, would be implemented […]
The AICPA defines a scope limitation as “An inability to obtain sufficient appropriate evidence.” In a SOC 1 or SOC 2 examination, a scope limitation may occur for the following reasons: Circumstances beyond the control of management. For example, documents that the service auditor considers necessary to inspect were in the […]
Multiple service offerings Most Type 2 SOC reports include a single service offering that was operational during the entire period covered by the report. In some instances, however, a Type 2 SOC report may include multiple service offerings. For these SOC reports, it is necessary that each of the services be […]