Compliance Absolutes to Avoid

In my line of work, it is not only advisable to have a mastery of the facts, but prudence would suggest that a good dose of foresight and reason based on actual experience can often times be as valuable a tool. Since the days of the SAS 70, we have seen several subjective opinions about both the appropriateness and/or the ineffectiveness of the SAS 70 report. Even today, there continues to be concerns on how SOC 1 reports, also known as SSAE 16 examinations, are being used in situations that fail to have bearing on internal controls over financial reporting.

Absolutely a Problem

The inappropriate application or misuse of the SAS 70 report was problematic for all parties involved, and in some cases truly misleading, particularly with regards to how the resulting report was described and relied upon. The marketplace abuses and confusion surrounding the now retired SAS 70 have been well documented, and written about at length, and in several cases, appropriately done. Additionally, the American Institute of Certified Public Accountants (AICPA) made leaps and strides to effectively communicate the intended use and reason for the SOC 1 reports.

However, good intentions oftentimes produce bad results. Although many of the public service announcements were initiated with positive intentions, these publications were mistaken and led to rhetorical battle lines being drawn. On one side were the proponents or the parties with vested interests in the effective use of SAS 70 reports. On the other side were those, who were looking to prove the performance of the SAS 70 as invalid. The main argument of the latter was the financial reporting relevancy of the SAS 70 audit's standard (AU 324) when pertaining to their definition of non-financial environments, such as data centers and colocation facilities.

Never is Almost Always Wrong

An example that was widely seen was industry publications that warned data centers against performing the SAS 70 examination. Even today, this notion continues with surgeon general-like warnings against the usage of the SOC 1 reports for data centers, cloud providers, and other like services. A few commentators have even suggested data centers should never use SOC 1 reports. At the same time, those voices suggested SOC 2 reports are always the better choice for cloud providers etc. However, as everyone knows absolute positions are usually if not always inaccurate. In this industry, absolute positions are even more certain to never be absolute.

The SOC 1 guide, Service Organizations - Reporting on Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting was revised in May of 2013, by the AICPA. In this revision, the AICPA provided instruction on the application of the SSAE 16 (SOC1) examination procedures for data centers, colocation facilities, cloud providers, etc. The timely release of the revised SOC 1 guide was an obvious reflection of the high demand, use, and reliance of SOC 1 reports by information technology general controls (ITGC)-only environments. This revision provided clarity and confirmed data centers can impact internal controls over the financial reporting of its customers. It also asserted the beneficial nature of data centers providing an SOC 1 report to its customers.

Always Avoid Never and Never Trust Always

My goal is to inform organizations to use due diligence and to be wary of absolute positions regarding compliance or audit matters. In the accounting and auditing profession, few attributes are more important than professional experience, which yields sound professional judgment. Professional experience and judgment always suggests rhetorical absolute statements should be put into the perspective of the specific organization.

As a safeguard for future references, organizations should understand the following key takeaways regarding the SOC 1 or SSAE 16.

• Never interpret a firm's experience to be representative of the auditor's individual experience. Instead, it's imperative to inquire about the individual auditor's experience with the assessments they promote.
• Always ask for potential audit vendors to provide their individual direct experience with the assessments they advise against.
• Always require potential audit vendors to give personal first-hand accounts of their individual performance at these engagements.
• Always ask for references.