What is a SOC report and should my company have one?

Who needs an internal controls assurance report?

There is currently no statutory requirement, however, they’re commonly performed for the following activities:

1. Custody;
2. Fiduciary management;
3. Fund accounting;
4. Investment management;
5. Investment administration;
6. Pension administration;
7. Private equity;
8. Property investment management;
9. Property investment administration;
10. Transfer agency; and
11. Information Technology.

These types of report are often requested by organisations (user entities) that receive significant services from a service organisation. User entities need transparency and assurance that relevant risks are effectively mitigated through appropriate controls.

This is of increasing importance for organisations operating within the financial services sector where there is increased pressure to demonstrate effective and robust control environments due to the rigorous compliance regimes in place.

What are the benefits of obtaining an internal controls assurance report?

Obtaining a SOC/ AAF report differentiates the service organisation from its peers by demonstrating effectively designed control objectives and control activities. In many cases, the report will also satisfy the user auditors’ requirements as well as specific requests from investors or customers.

Who are the users of these reports?

The users can be both internal and external e.g.

• Internal management at the service organisation 
• External parties such as customers (or potential customers), investors or the external auditors of customers.

Get in touch

If you would like to find out more about our controls assurance reporting services, complete the form below.