At Grant Thornton, we support our clients in obtaining SOC 1, SOC 2 and SOC 3 reports, enabling them to provide assurance to their clients and partners regarding the design, implementation and operation of adequate internal controls, highlighting the organisation’s commitment to the highest standards of control and security.

SOC (Service Organisation Control) reports are the result of applying a set of audit standards and guidelines established by the American Institute of Certified Public Accountants (AICPA) expressed in SSAE 18 (Statement on Standards for Attestation Engagements No. 18).

What are the differences between SOC 1, SOC 2 and SOC 3?

SOC 1 assesses internal controls related to the financial information of your clients. SOC 2 focuses on the organisation’s non-financial controls, covering the following pillars: security, availability, processing integrity, confidentiality and data privacy.

SOC 3 is a general public report that assesses the security, availability, processing integrity, confidentiality and privacy internal controls of a service organisation, without including technical or confidential details.


Approach

Objectives

Criteria
Report Types
Type 1 Type 2
SOC 1
Internal controls affecting clients’ financial reporting.
To provide users with assurance that the organisation’s internal controls are adequate to protect financial statements.
No established criteria, but rather they are defined by the organization according to its functions and the implemented controls.
Assesses the design of controls at a specific point in time.
Assesses the design of controls and operational effectiveness over a defined period (e.g., six or twelve months).
SOC 2
Non-financial controls relevant to information security.
To assure clients that the organisation’s data and systems are protected.
Based on the Trust Services Criteria (TSC), covering five key areas: security, availability, processing integrity, confidentiality and privacy.
Assesses the design of controls at a specific point in time.
Assesses the design of controls and operational effectiveness over a defined period (e.g., six or twelve months), providing a more comprehensive overview of control performance.
SOC 3
General information security compliance report for sharing with third parties.
To demonstrate compliance with the Trust Services Criteria (security, availability, processing integrity, confidentiality and privacy).
It is a public report without technical or confidential details.
Not applicable.
Not applicable.

Why is it important to have a SOC Report?

Certification enables organisations that provide services and handle sensitive client information, such as cloud service providers (SaaS), data centres, financial services, healthcare centres, marketing, and accounting, tax or payroll outsourcing, among others, to:

âś“ Demonstrate the security of a company’s control systems.

âś“ Present the report to their clients, reducing the need for them to invest internal resources in auditing the organization as a vendor.

âś“ Win new clients. Nowadays, many companies require these certifications from those submitting service proposals.

Why Grant Thornton

At Grant Thornton, we help our clients build trust in their services by assessing their needs and advising them on best practices to meet compliance and reporting requirements, including system and organisation controls (SOC) reports. We have the experience, global reach, innovation, skill and the highest levels of quality required for these audits.

We work in collaboration with our clients across the service industry, including financial services, to identify business processes and IT controls to mitigate risks. Our knowledge of the regulations of the Central Bank of the Argentine Republic (BCRA – Banco Central de la República Argentina) makes us the perfect partner for financial services companies and those providing services to the financial industry.