Back To Top
SOC Reporting Services

Providing Assurance to Your Controls

YHB’s Risk Advisory Services Team can help you provide your clients with assurance of the controls you have in place to protect them and their customers.

YHB’s Risk Advisory Services Team has been providing Service Organization Controls (SOC) , and its predecessor SAS70, engagements for over 12 years. We work with companies that range from just a handful of employees to companies with thousands of employees. Our expertise in recognizing and testing controls for organizations of all sizes bring international clients to YHB. We work with our clients to make sure they provide the users of their services with an accurate description of the controls they have in place.

If a SOC 2® engagement is the right one for you, we bring 15 years of experience working with the Trust Services Principles (TSP). We have been using the TSP framework to provide IT Audits (SysTrust) for many of our financial institution clients even before SOC 2® engagements existed.

YHB-SOC-audits

When you are considering your first SOC engagement, you need a firm that can help you identify which controls matter. We help you describe your environment in an efficient and effective way, allowing your clients to easily understand the quality service you provide. Our approach to first year engagements is to perform a Readiness Assessment before the audit period begins. The Readiness Assessment helps you create the description of your control environment, identify the appropriate controls to fit your control objectives (SOC 1®) or the TSP (SOC 2®), and test the controls to make sure they are working as described. Once we have identified the controls and any weaknesses in them, we help you through the remediation process, preparing you for your first SOC audit.

Your relationship with YHB does not end when the report is issued. We continue to be a resource to you as changes in your environment or your industry force changes in your controls and processes.

YHB’s Risk Advisory Services Team can help you provide your clients with assurance of the controls you have in place to protect them and their customers.

Need help determining what type of SOC engagement you need? Download our SOC Guide

What Are SOC Engagements?

Service Organization Control (SOC) engagements have become the gold standard for examining, assessing and reporting on internal controls at service organizations. SOC engagements were developed by the CPA profession, which has long been a thought leader in assurance engagements. CPAs are the premier providers of SOC reports for service organizations that must reassure users about their systems.

Organizations like yours receive requests from customers for assurance on a number of fronts, including assurance about your systems’ controls over financial reporting (SOC 1® also known as SSAE16 engagements) and the controls you employ to protect the privacy and confidentiality of users’ data, as well as the security, availability and processing integrity of your systems (SOC 2® and SOC 3® engagements).

SOC 1® Report (SSAE18)

Reporting on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting

SOC 1® meets the needs of user entities’ management and auditors as they evaluate the effectiveness of a service organization’s controls on a user entity’s financial statement assertions. These reports are important components of user entities’ evaluation of their internal controls over financial reporting for purposes of compliance with laws and regulations and for when user entity auditors plan and perform financial statement audits.

SOC 2® Report

Reporting on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (SOC 2®)

For those who need to understand internal control at a service organization as it relates to security, availability, processing integrity, confidentiality or privacy. These reports play an important role in oversight of the organization, vendor management programs, internal corporate governance and risk management processes, and regulatory oversight. Stakeholders who use these reports include management or those charged with governance of the user entities and of the service organization, customers, regulators, business partners and suppliers, among others.

SOC 3® Report

Trust Services Principles, Criteria, and Illustrations

Designed to accommodate users who want assurance on a service organization’s controls related to security, availability, processing integrity, confidentiality or privacy but do not have the need for the detailed and comprehensive SOC 2® Report. It can be used in a service organization’s marketing efforts.


Ready to provide assurance to your controls? Contact Us

Let's Talk

Contact us when it’s time to move forward.

Bryan Newlin
X
Bryan Newlin
CPA.CITP, CISA
Connect:
Industries
About Bryan

Bryan began his career with Yount, Hyde & Barbour in 2005, and has been a key leader in YHB’s respected Risk Advisory Services practice since 2007. In his role as IT Audit Principal, Bryan is responsible for IT audit program design, engagement quality, IT audit staff training and development, and the firm’s Vulnerability and Penetration testing practice.

He has authored articles for The Community Banker, Virginia Business, and is a regular contributor to YHB’s deTECH newsletter. He has been a featured speaker at banking industry conferences in Virginia. Bryan became a Certified Information Systems Auditor and Certified Public Accountant in 2008, and Certified Information Technology Professional in 2011.

Stephen M. Weber
X
Stephen M. Weber
MBA, CISA
Connect:
Industries
About Stephen

Stephen joined YHB in 2018 with extensive experience in IT Audit and Advisory Services.  His background includes internal and external IT Audit services for state and federal agencies and  Fortune 500 companies in retail, manufacturing and financial lending. Most recently, he was an instructor at Virginia Commonwealth University focusing on technology-related courses in the Accounting Department’s graduate and undergraduate programs.

 

Expertise

His expertise spans financial statement audits, SOX, project management, legal and compliance and data analytics.  Stephen earned his Masters of Business Administration from the University of Richmond and Bachelors in Business Information Technology from Virginia Tech.  He is actively involved in ISACA.

Stephen also completed ISACA®’s Cybersecurity Audit Certificate Program.

cybersecurityaudit-logo

ISACA’s Cybersecurity Audit Certificate Program provides security professionals with an understanding of the audit process, and IT risk professionals with an understanding of cyber-related risk and mitigating controls.

R. Curtis Thompson
X
R. Curtis Thompson
CPA.CITP, CISA
Connect:
Industries
About Curtis

Curtis joined YHB in 1995, with a B.S. degree in accounting from Shepherd University. He is a member of the American Institute of Certified Public Accountants, the Virginia Society of Certified Public Accountants and the ISACA (Information Systems Audit and Control Association.)

Experience

Curtis developed his business acumen through owning a retail store and serving as the general manager of a regional oil company. At YHB, his work in the tax department and consulting with small businesses continued to develop this experience.  Throughout his time at YHB he has provided IT audit and consulting to clients, even while holding the position of the firm’s IT director for several years. Now, as head of the YHB Risk Advisory Services Team, Curtis focuses on assisting organizations in a variety of industries with SOC Audits, internal audits, and IT-related audit and consulting services. He frequently speaks and gives presentations on Cybersecurity, internal controls, and IT issues.

Expertise

As a Certified Information Technology Professional (CITP) and a Certified Information Systems Auditor (CISA), Curtis brings highly specialized training and knowledge to bear on client needs. This expertise, as well as his real world business and technical experience, has given him a broad understanding of both IT and operational processes, which makes him especially effective at analyzing and evaluating the controls over these processes. Also, because he’s worked on the management as well as the technical side of IT, Curtis excels in explaining to management the business risks associated with various IT issues.

Approach

Curtis’ mantra is: “We do our best work when we’re having fun.” This attitude enables him to bring a fresh perspective to even the most challenging situations and find solutions that strengthen controls. He starts by first evaluating a system’s risks. Then figuring out how the company has mitigated them. But he doesn’t just look back and point out what’s “wrong” with a system. Instead, he strives to add value by helping clients look forward and proactively control the risks.

Other Interests

In his free time, Curtis enjoys antiquing, woodworking, and restoring his old VW Bug. Curtis is also an avid motorcycle enthusiast who rides a Harley Davidson Ultra Classic.

Brad Brosig
X
About Brad

A Western Pennsylvania native, Brad graduated from Indiana University of Pennsylvania in 2014 with Bachelor’s Degrees in Accounting and Management Information Systems. He joined YHB that same year and has since split his time between both the Bank team and the Risk Advisory Services team completing external and internal financial audits, SOX consulting services, and IT related audit and consulting services. Brad became a Certified Information Systems Auditor in early 2019.