control failures noted in those reports. Obtaining and monitoring SSAE -18 reports is a way to limit risk if the of controls over financial operation and information VA’s Vendor’s own lack security may lead to substantial misrepresentation of financial information, impairment VA’s of security controls or breach of privacy data. If a service is significant to financial statements, requiring a organization’s activity VA’s Service Organization Controls (SOC) 1 Type 2 audit and report may be warranted. If a service related to information systems (including information organization’s activity security and privacy data controls) could seriously jeopardize VA achieving a substantial mission objective, requiring a SOC 2 Type 2 audit and report may be warranted. Examples include services such as the ability to access electronic health records or ability to pay VA employees in a timely way, etc. The American Institute of Certified Public Accountants (AICPA) Statement on Standards for Attestation Engagements No. 18, Attestation Standards: Clarification and Recodification (SSAE 18) suggests that management should work with their supporting (VA) contracting officer to establish contractual requirements to obtain independent audit reports attesting to the controls of service organizations and for those organizations performing services that are material to either financial statements or mission objectives. Service Organization VA’s Controls (SOC) (recently renamed System and Organizational Controls (SOC) for Service Organizations) reports most relevant to VA contracts include: 1. SOC 1, Type 2 Reports on the design and operating effectiveness of controls for a – service organization significant to internal controls over financial reporting throughout a VA’s specified period. These reports, prepared in accordance with SSAE 18, section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting, are specifically intended to meet the needs of entities that use service organizations (user entities) and the CPAs that audit the user entities’ financial statements (user auditors), in evaluating the effect of the controls at the service organization on the user financial statements. entities’ 2. SOC 2, Type 2 Reports on the design and operating effectiveness of a service – organization relevant to Security (of Information and Systems), Availability (of Information and Systems), Processing Integrity, Confidentiality, and Privacy throughout a specified
control failures noted in those reports. Obtaining and monitoring SSAE -18 reports is a way to limit VA’s risk if the Vendor’s own lack of controls over financial operation and information security may lead to substantial misrepresentation of VA’s financial information, impairment of security controls or breach of privacy data. If a service organization’s activity is significant to VA’s financial statements, requiring a Service Organization Controls (SOC) 1 Type 2 audit and report may be warranted. If a service organization’s activity related to information systems (including information security and privacy data controls) could seriously jeopardize VA achieving a substantial mission objective, requiring a SOC 2 Type 2 audit and report may be warranted. Examples include services such as the ability to access electronic health records or ability to pay VA employees in a timely way, etc. The American Institute of Certified Public Accountants (AICPA) Statement on Standards for Attestation Engagements No. 18, Attestation Standards: Clarification and Recodification (SSAE 18) suggests that management should work with their supporting (VA) contracting officer to establish contractual requirements to obtain independent audit reports attesting to the controls of service organizations and for those organizations performing services that are material to either VA’s financial statements or mission objectives. Service Organization Controls (SOC) (recently renamed System and Organizational Controls (SOC) for Service Organizations) reports most relevant to VA contracts include: 1. SOC 1, Type 2 – Reports on the design and operating effectiveness of controls for a service organization significant to VA’s internal controls over financial reporting throughout a specified period. These reports, prepared in accordance with SSAE 18, section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting, are specifically intended to meet the needs of entities that use service organizations (user entities) and the CPAs that audit the user entities’ financial statements (user auditors), in evaluating the effect of the controls at the service organization on the user entities’ financial statements. 2. SOC 2, Type 2 – Reports on the design and operating effectiveness of a service organization relevant to Security (of Information and Systems), Availability (of Information and Systems), Processing Integrity, Confidentiality, and Privacy throughout a specified
flash18-22attachment.docx