Today more than ever, companies rely on service providers to streamline day-to-day operations and ensure continued functionality. This is evident through the emergence of cloud computing, data centers, and software-as-a-service (SaaS) organizations. However, with the ease and convenience of these outsourced tasks comes some degree of inherent risk. A key differentiator […]
As service organizations transition to and begin using the 2017 Trust Services Criteria for SOC 2 reporting, some smaller companies are struggling with one of the new criteria related to the board of directors (CC1.2). Specifically, how can they address this criteria if they do not have a board of directors […]
Consumers are doing more and more of their shopping on Amazon because it is convenient, cost-effective, quick and simple to use. In a similar respect (and for the same reasons), there are an increasing number of companies moving their IT environments to Amazon Web Services (AWS). One of the many benefits […]
One of the most challenging aspects of a System and Organization Controls (SOC) engagement is evaluating exceptions / control failures and determining how they will impact the SOC report and whether they will result in a qualified or adverse opinion. The purpose of this whitepaper is to help service organizations understand […]
One of the challenges that many service organizations face while completing a SOC 2 engagement is addressing the risk assessment and risk mitigation criteria found in TSP Section 100: 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality and Privacy (TSC). Kfi has published a whitepaper to: identify the risk […]
One of the most interesting documents that comes across my desk each year is the Global Study on Occupational Fraud and Abuse published by the Association of Certified Fraud Examiners (ACFE). The 2018 study (which can be downloaded at the bottom of this post) contains an analysis of 2,690 cases of […]
There are significant changes coming down the pike for SOC 2 reports. Kfi has prepared a whitepaper to help you prepare: SOC_2_Changes_White_Paper
The purpose of this whitepaper is to describe prevalent IT security vulnerabilities and the corresponding controls that companies deploy to respond to them. KFI-Top 10 IT Security Vulnerabilities-White-Paper
In April 2017, the American Institute of Certified Public Accountants (AICPA) released a new framework for cybersecurity risk management that can help businesses meet the growing challenges that they face from cybersecurity threats. The purpose of this whitepaper is to provide answers to some of the frequently asked questions that Kfi […]
SSAE No. 18 is effective for SOC reports, Agreed Upon Procedures and examination reports dated on or after May 1, 2017. Kfi has prepared a whitepaper summarizing the changes that you can expect relative to SOC reporting. KFI-SSAENo18-White-Paper