Strategic Assurance & SOC Services

Assessing effectiveness, building customers’ trust

Our assurance professionals assist organizations in building trust in their services by assessing needs and advising them on leading practices to satisfy compliance and reporting mandates, including System and Organization Controls (SOC) reports and other assurance services.

We use a “test once, apply many” approach and our leading-edge SOC services automation product — SOC.x — to drive efficiencies and enhance an organization’s compliance process. We can help you determine which attestation reports and/or certifications meet your needs.

ARTICLE

Reducing banking risks with common controls

Establishing a common control framework can smooth compliance implementation for banks, particularly when new technological tools are used.

How we can help you

Our teams perform engagements with a balance of experience, scale, innovation and skill and the highest levels of quality.

SOC 1

A SOC 1 report is designed to help meet the needs of user entities and their financial statement auditors. When service organizations provide services... Show more that affect the financial reporting processes of their clients (user entities), they may need to provide SOC 1 reports to their user entities. The SOC 1 report communicates the design and operating effectiveness of a service organization’s controls relating to a user entity’s internal control over financial reporting.

SOC 2, SOC 2+

A SOC 2 report provides user entities with an understanding of a service organization’s controls designed and implemented to help it achieve certain service... Show more commitments and system requirements. Those controls are evaluated against the AICPA’s trust services criteria, which cover subjects such as security, availability and processing integrity of the systems used to process its users’ data, or how it helps secure the confidentiality and privacy of the data.

A SOC 2+ report addresses the relevant SOC 2 trust service criteria plus additional criteria that may include controls relating to other frameworks such as: HIPAA, HITRUST, NIST, ISO, Sheltered Harbor, CSA Star or other specified subject matter.

SOC 3

A SOC 3 report meets the needs of users similar to a SOC 2 report, but without the details of the criteria, controls, tests and results of testing. As a ... Show more general use report, this report can be more freely distributed than a SOC 2 report.

SOC for Supply Chain

A SOC for Supply Chain report is related to an entity’s system and controls for producing, manufacturing or distributing goods. Organizations can use... Show more the reporting framework to communicate to stakeholders relevant information about their supply chain risk management efforts and the processes and controls they have in place to detect, prevent and respond to supply chain risks.

SOC for Cybersecurity

A SOC for Cybersecurity report enables companies to demonstrate and communicate due diligence and due care in their management of... Show more cybersecurity risk. The cybersecurity risk management reporting framework, developed by the AICPA, provides a mechanism through which organizations can communicate relevant, useful information about the effectiveness of their cybersecurity risk management program.

HITRUST

HITRUST has developed a standard report that provides a consistent representation of risk exposure, compliance posture and corrective actions that allow for... Show more the benchmarking of an organization’s security practices against security practices at similar organizations in the industry. Grant Thornton is approved by HITRUST as an external assessor.

General Examinations

Leveraging the AICPA’s attestation standards, our assurance professionals work closely with an organization to define a customized “subject matter” that is... Show more objective, measurable and relevant for their purpose. A general examination is a highly flexible project that allows an organization to focus on the information that they believe will be most helpful to their customers and avoid reporting on controls that may be less relevant to their customers.

Agreed-Upon Procedures

Utilizing the AICPA attestation standards, our assurance professionals perform a series of “agreed-upon” procedures and report the results. This type of... Show more report is a great way for our clients to satisfy specific compliance requests from their customers.

Compliance Examinations

The practitioner’s objective in this engagement performed under the AICPA attestation standards is to examine an organization’s compliance with... Show more requirements of specified laws, regulations, rules, contracts or specified requirements or management’s assertion about compliance with the specified requirements (e.g., Regulation AB, USAP). The engagement may also be performed to assess an entity’s internal control over compliance with specified requirements.

Readiness Assessments

Performed under the AICPA consulting standards, readiness assessments help prepare organizations to be examined for compliance with... Show more attestations and certifications. Readiness assessments can be performed for SOC reports, HITRUST, HIPAA, ISO, CMMC, General Examinations, NIST 800-171, FedRamp and other IT frameworks.

Request a meeting -->