Understand the Service and the Related Risk
Organizations increasingly rely on service providers to perform activities that support financial reporting, technology operations, security, data processing, and other important business functions. This reliance can improve efficiency and provide access to specialized capabilities, but it does not transfer responsibility for managing the associated risks.
SOC reports are commonly used to obtain information about controls at service organizations. However, not every service provider has a SOC report, and an available report may not always address the services, systems, controls, or period relevant to the organization.
The absence of a SOC report does not necessarily mean that a service provider should not be used. It does mean that management should determine whether other procedures are necessary to obtain sufficient assurance over the services being provided.
Before determining what alternative procedures are appropriate, the organization should understand how the service provider is being used.
A provider that performs a limited administrative function generally presents a different level of risk than one that hosts critical applications, processes financial transactions, maintains sensitive information, or performs controls upon which the organization relies.
Management should consider the services being performed, information and systems involved, significance of the related business processes, regulatory requirements, and potential impact if the provider does not perform as expected.
This understanding provides the basis for determining how much assurance is necessary.
Determine What Assurance Is Already Available
The absence of a SOC report does not mean that no information about the provider's control environment exists.
Depending upon the nature of the organization and services provided, other assessments or certifications may already address some of the relevant risks. A government service provider, for example, may be subject to control assessments performed under applicable federal requirements. Other providers may have independent security assessments, certifications, regulatory examinations, penetration testing results, or internal audit activities.
Existing information should be evaluated to determine whether it addresses the risks and controls relevant to the services being used.
The objective should not be to obtain a particular document simply because it is familiar. The objective is to obtain sufficient information to understand whether relevant risks are appropriately managed.
Use Alternative Procedures Where Necessary
When existing assurance is insufficient, management may need to perform additional procedures.
These procedures can vary considerably based on risk. They may include reviewing policies and procedures, completing control questionnaires, conducting interviews or walkthroughs, inspecting supporting documentation, evaluating contractual requirements, or directly testing selected controls.
For higher-risk relationships, a more formal assessment of the service provider's control environment may be appropriate.
The extent of these procedures should reflect the significance of the service and the level of assurance already available. Performing an extensive assessment of a low-risk provider may provide limited additional value, while relying solely on a questionnaire for a provider supporting a critical business process may not provide sufficient assurance.
Consider the Organization's Own Controls
Service provider risk should not be evaluated exclusively by looking at controls maintained by the provider.
The organization may have controls that reduce the risk associated with the outsourced activity. These can include reconciliations, transaction reviews, access restrictions, exception monitoring, approval requirements, data validation, or other activities performed internally.
Understanding these controls is particularly important when external assurance is limited.
A weakness at the service provider does not always result in an equivalent level of residual risk if effective controls exist within the organization. Conversely, strong controls at the provider may not address responsibilities that remain with the organization.
Both sides of the relationship should therefore be considered.
Match the Assurance Approach to the Risk
A SOC report can provide valuable information about a service provider's control environment, but it is one method of obtaining assurance—not the objective itself.
When a SOC report is unavailable, organizations should avoid treating the situation as either an automatic control failure or simply accepting the risk without further evaluation. Instead, management should determine what information is available, identify what remains unknown, and perform additional procedures where warranted.
The appropriate approach will depend upon the nature of the service, the risks involved, existing assurance, and controls maintained by both the provider and the organization.
Ultimately, effective third-party risk management requires sufficient assurance over the risk—not necessarily a specific type of report.