Assured Audit Approvals.
Choose OSS!
Service Organisation Controls (SOC) 1 aims to protect the interest of the user entity while receiving services from the service organisation.
Upon implementation of the framework, it is a demonstration of internal control over financial reporting (ICFR). We have a 6-phase Methodology, to help you achieve successful SOC 1 compliance.
In Coral, we have a formal methodology to fulfill and implement ISO 27701/privacy information management system.
Service Organization Controls (SOC 1) is aimed at assuring a user entity that there are adequate Internal controls over financial reporting (IFCR).
We have a structured approach to determine the applicable list of risks and controls that are required to achieve SOC 1 attestation. Our 6-phase approach ensures that the service organisation has adequate ‘internal controls’ to assure any Certified Public Accountant (CPA) for issuance of SSAE 18 in USA, and professional accountant in public practice for issuance of ISAE 3402, globally.
This phase involves determining key business objectives, from user entity, as well as of the service organisation.
This phase involves performing gap analysis of the above listed objectives on one hand, and the applicable SOC 1 controls and risks, on the other. We provide solution for all identified gaps.
This phase involves our methodology that involves distribution of risks, and control responsibility to internal stakeholders. This also includes nomination of key roles such as risk officer – who will drive the ongoing compliance.
This phase involves tracking the client risks, documentation and self-compliance on a weekly basis till all internal controls are adequately implemented.
This phase involves measuring internal control changes on a scale of 0-100%. This gives assurance to internal stakeholders that the processes implemented are adequate (or at risk). If there are deviations or risks identified, they are treated.
Internal audit followed by a formal review of the program gives organisation an independent perspective, and enables them to be ready for final attestation.
At this stage the client has implemented the governance system in completeness. Generally upon completion of one month of this, the organisation can achieve SOC 1 – Type 1 attestation, and upon completion of 6 months, the client can achieve Type 2 attestation. Here the assumption that all risks are under control that will give adequate assurance to the user entity.
Attestation standard used by global professional accountants to attest SOC 1 controls.
Attestation standard used by US based CPAs to attest SOC 1.
