Is your SOC program paying off? Ask these four questions

Publication
6 minute read

System and organization controls (SOC) reporting is standard practice for technology and service providers to help build trust with key stakeholders. SOC and other external controls reports detail how companies secure client data, protect private information and uphold contractual commitments related to data processing and system availability.

But without a structured approach, SOC programs may monopolize more resources than they should and get bogged down in unnecessary complexity. A SOC program may not be integrated with other compliance efforts — and it may even be treated as an afterthought.

Mergers and acquisitions can exacerbate these challenges. PwC has worked with a number of companies that faced challenges related to their external controls reporting as a result of deals activity. Some of these challenges include managing a larger number of SOC reports and other certifications than compliance programs were originally designed to manage, navigating multiple external auditors as well as the costs associated with blending several compliance teams together. There are opportunities to consider that may help an organization navigate some of these challenges, including leveraging technology tools and basic automation to help improve overall efficiency and streamlining and monitoring routine elements of associated reporting tasks.

With these solutions, we have helped clients facing third-party reporting challenges rationalize their inventory of deliverables and streamline their compliance teams. Merging organizations were able to adapt to the changes in their reporting environment, employ industry and in-house technology and tools, and build out existing system capabilities to help improve the interconnectedness and efficiency of the compliance program and reporting efforts.

Thinking about enhancing your own reporting process? Whether you are experiencing M&A activity or not, there may be opportunities to help increase efficiency while you enhance value and build trust. Here are four questions to consider that can help you evaluate your approach to external controls reporting.

When you look to enhance your external reporting and certification program, matching your team’s skills to your reporting inventory can be key. It may sound obvious, but skipping a skills assessment around external controls reporting is a relatively common mistake — especially after a merger. You should have team members with a working knowledge of security protocols and systems, as well as industry-specific requirements.

In one case, a pharmacy chain acquired a healthcare provider, but the acquiring firm didn’t have the in-house skills needed to produce the necessary SOC reports. They sought help from PwC to advise them on what reports were necessary and to serve as their project management office to help deliver their SOC reports to intended third parties.

What’s more, SOC and other controls reporting requirements may vary by sector — and there’s a host of industry-specific security standards that many service providers comply with to help meet customer expectations.

When a payroll service provider wanted to attract new clients in the media space, it sought to boost its reporting team’s understanding of the types of reports and certifications specific to the media industry. The team sought to connect and share knowledge with other companies to get up to speed on what reports and certifications media clients expect, including specific expectations on compliance reporting. Team members are now working to curate a reporting inventory to focus on.

Some controls covered in certain reports may overlap with industry-specific or regulatory-driven quality management certification protocols or reporting requirements, which can be an additional opportunity to help increase efficiency by combining efforts.

If you don’t actively monitor SOC and other external controls reporting activity, you may end up producing too many reports as well as some that simply aren’t necessary.

To address this, a technology provider asked PwC to help create a framework to vet reporting requests. The new process captures useful information such as the source of the request, the number of customers or stakeholders that would benefit, whether the lack of certification or report could impede new business and whether adding it could create new business. Assessing these details can help the reporting team make a more informed decision about whether to add new deliverables — as well as a way to evaluate the potential value of newly added reports.

Additional efficiency measures include exploring the possibility of delivering reports across groups of similar products rather than individual ones and comparing your control inventory to illustrative trust services criteria, control objectives and controls published by the American Institute of Certified Public Accountants (AICPA) so they can determine if your reports match industry expectations.

An organized approach to issues management can help streamline SOC and other controls reporting by establishing a process for handling issues — how they’re communicated and who should review them, as well as a timeline for doing so. External auditors strive to assist clients in working through issues to get better answers so they can help resolve them, but having guidance in this area leaves less room for error.

Many compliance and risk teams already use or are familiar with a variety of governance reporting and compliance (GRC) tech tools, some of which can be used to help streamline external controls reporting as well. Every industry has unique requirements and expectations, so the tools that work better may differ sector to sector.

Too many companies still track this activity in Excel spreadsheets when they could be using automation to help speed up and improve the efficiency of data collection and internal data sharing. Some GRC tools, for instance, let you generate certain reports or aggregate certain data in batches to share with the relevant teams at specified intervals. You can also leverage technology tools to standardize the look and feel of your reporting deliverables so they can appear polished and present unified branding.

Smarter SOC in action: Consider the impact on deals

Acquiring another company in your industry is a common way to open up new revenue streams or lines of business. Be sure to consider external controls reporting in your risk assessment.

Take, for example, a financial services technology company that acquired an e-commerce tech provider. Rather than assessing and rationalizing the combined reporting work of both companies — which can be significant in highly regulated industries like finance — the acquiring company kept adding single-user, single-product reports for its clients. Management realized the company was producing more than 100 reports and certifications at a cost of $3 million in staffing. They sought help from PwC to assess and rationalize their reporting inventory to provide coverage for their intended users, while also increasing efficiencies and reducing redundancies within their team that supports the delivery of the reports. But they could have likely avoided some associated costs if they had considered the impact of the acquisition on reporting efforts prior to closing the deal.

The value of streamlined SOC reporting

Companies that rework their approach to SOC and external controls reporting with an eye to helping prevent duplicate efforts, streamline processes and enlist time-saving technology are often better positioned to enjoy a return on their investment in these efforts — greater overall efficiency, smarter use of reporting teams and a curated inventory of reports that current and prospective customers can rely on for assurance around data security and other controls.

Contact us

Jennifer Kosar

Trust and Transparency Solutions Leader, PwC US

Jay Schaldecker

Trust and Transparency Solutions Leader, PwC US

Bryan Lutz

Digital Assurance and Transparency Partner, PwC US

Audit and Assurance services Consulting Tax services Newsroom Alumni US offices Contact us

© 2017 - 2024 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details.

Is your SOC program paying off? Ask these four questions

Smarter SOC in action: Consider the impact on deals

The value of streamlined SOC reporting

{{filterContent.facetedTitle}}

{{item.title}}

Contact us