Linkedin
Facebook
Email
more
Expert support for SOC compliance
Outsourcing is more common than ever, but working with third parties can introduce risks to your operations.
- Organisations need concrete assurance that their third-party vendors have proper controls in place.
- Service providers need a reliable way to demonstrate the integrity of their control environment and their commitment to security and governance.
- SOC compliance and reporting is the solution to meet both these needs.
RSM Australia has deep experience with SOC audits and assurance. This means we know what to look for when interpreting a SOC 1 or SOC 2 report supplied by a third-party vendor.
We also know how to prepare for an SOC audit, strengthen your controls and produce credible SOC reports. This gives your customers, partners and stakeholders confidence in your financial controls and security posture.
Whatever your SOC compliance needs, RSM is here to help.
Which SOC report is right for your business?
Understanding the different types of SOC reports can be confusing. The two most common reports are SOC 1 and SOC 2, each serving a distinct purpose.
The right choice depends on the services your organisation provides and the specific assurance your clients require.
A SOC 1 report is designed for service organisations whose internal controls could impact their clients' financial statements.
If you provide services like payroll processing, claims administration, or data centre hosting, a SOC 1 report offers assurance that your controls are suitably designed and operating effectively.
In Australia, this report may also be called ASAE 3402, ISAE 3402 or GS007, referring to the assurance standard used.
As the types of services provided and the needs of clients can vary significantly, it is often a good idea to invite major stakeholders to contribute to the scope of your SOC 1 report.
Given the sensitive data involved, SOC 1 reports are intended for a ‘restricted’ audience, such as your clients and their auditors.
Type I: Evaluates the design and implementation of controls at a specific point in time.
Type II: Tests the design, implementation, and operating effectiveness of controls over a specific period (usually six to twelve months), delivering a higher level of assurance.
SOC 2 reports have gained significant popularity as data security becomes a primary concern for all organisations.
For service providers who manage, process or store sensitive information, a SOC 2 report is a way to articulate your controls and demonstrate how you protect customer data. Examples include SaaS companies, IaaS providers, data centres, AI services or information security services.
The SOC 2 framework addresses controls related to one or more of the five Trust Services Criteria (TSC):
- Security: Protecting information and systems against unauthorised access and use.
- Availability: Ensuring systems are available for operation as committed or agreed.
- Processing integrity: Verifying that system processing is complete, valid, accurate, and authorised.
- Confidentiality: Protecting information that is designated as confidential.
- Privacy: Addressing the collection, use, retention, disclosure, and disposal of personal information in conformity with the commitments in the entity's privacy notice.
SOC 2 is also ‘restricted use’ and is especially valuable to organisations needing to assure clients about the security and privacy of outsourced IT and data services.
Type I: Evaluates control design and implementation at a moment in time.
Type II: Includes operational effectiveness testing over an extended period, providing deeper insights into ongoing risk management and capacity to meet the service commitments and system requirements based on the applicable TSC selected for the report.
SOC 2+ extends traditional SOC 2 coverage, enabling you to integrate additional controls and frameworks that may be important for your industry or region. For example, SOC 2+ can incorporate requirements from ISO 27001, NIST, HITRUST, HIPAA, or local standards like the Consumer Data Right (CDR) in Australia. This flexibility allows you to demonstrate multi-framework compliance in a single report, providing powerful, tailored assurance to a broad range of stakeholders.
SOC 3 delivers the broad assurance of SOC 2 but in a format intended for general, unrestricted distribution. The report offers a summary of your organisation’s controls aligned to the TSC, designed to publicly validate your security and privacy posture. SOC 3 contains no sensitive details, making it ideal for marketing and public trust, but with less granularity than a SOC 2.
How RSM guides you through SOC reporting
Whether you need to interpret a SOC report from a third party or prepare for your own audit, RSM Australia is here to support you at every stage. Our deep experience in SOC 1 and SOC 2 audits allows us to tailor an approach that addresses your key concerns and business objectives.
Our SOC assurance services include:
Readiness assessments
Before you commit to a formal audit, our expert team can perform a readiness assessment to identify potential control gaps and provide operational recommendations. This proactive step helps streamline the audit process and reduces compliance costs.
Identifying the right report
We help you determine which report—SOC 1, SOC 2, or an enhanced SOC+ report (e.g., SOC 2 + Consumer Data Right)—best validates your commitment to internal controls and provides the assurance your customers require.
Control design and implementation
Our team can suggest value-adding internal controls and help you implement them effectively, strengthening your overall security posture.
Audit and attestation
We complete the formal SOC audit engagement efficiently, providing you with a clear and credible SOC report to share with your stakeholders.
Have a follow up question for our team?
Get in touch
Have a follow up question for our team?
Get in touch
Frequently asked questions about SOC reporting
A SOC report is an independent attestation of your organisation's control environment. It provides a clear, consistent way to communicate your commitment to security and compliance, giving your customers, partners and stakeholders confidence in your financial controls and security posture.
Both SOC 1 and SOC 2 reports are available in two forms:
Type 1: A report on the fairness of the presentation of management’s description of the service organisation’s system and the suitability of the design of the controls to achieve the related control objectives included in the description as of a specified date.
Type 2: A report that includes the Type 1 criteria, as well as the operating effectiveness of the controls over a specified period. This offers a higher level of assurance.
As Australian organisations increasingly rely on a digital ecosystem of cloud-based services, information security has become a growing priority. Organisations face more frequent and sophisticated security threats than ever before.
Between concern over these risks and rising regulations, stakeholders require concrete assurance that their data is protected.
A SOC report is an independent attestation of your control environment, offering a clear and consistent way to communicate your commitment to security and compliance. This not only builds trust but also provides a significant competitive advantage.
