SOC 2 case study: an ITES and BPO provider

The organisation and what it needed

The organisation is an IT-enabled services and business process outsourcing provider. Its clients hand it work that touches their own systems and data, and before trusting a vendor with that work, many of them want to see the security arrangements for themselves.

That expectation had turned into a recurring burden. Client after client sent its own security auditors, each with its own questions, its own evidence requests and its own timetable.

What the provider needed was a better way to demonstrate its security practices: one piece of independent evidence that existing clients and prospects could both rely on, instead of a fresh audit for every relationship.

What was implemented

With Sterling, the provider overhauled its security operations. The work was aimed at controls that would stand up to an independent SOC 2 examination rather than satisfy one client's checklist at a time.

Once the controls were in place, a licensed CPA firm acting as the service auditor examined them and issued a SOC 2 report. Sterling prepared the organisation for that examination; the opinion in the report belongs to the CPA firm alone. The report is an attestation, not a certificate, and no certificate is involved at any stage.

What changed

The report reassured clients. Instead of arranging their own audits, they could read one independent assessment of the provider's controls, and the repetitive client audits it had been absorbing were replaced by that single document.

It also changed the pace of new business. Onboarding of new clients sped up, because the security question could be answered with the report rather than with another round of fieldwork. The provider went on to win high-profile contracts and to broaden its client base.

Its chief information security officer said that clients now entrust the organisation with their most sensitive information, and that this trust is driving its growth.

About SOC 2

SOC 2 is the AICPA's reporting framework for the controls a service organisation runs over the systems that handle its clients' data. The controls are assessed against the Trust Services Criteria: Security is examined in every report, while availability, processing integrity, confidentiality and privacy are added when the organisation chooses to include them.

The report is issued by a licensed CPA firm after an examination performed under the AICPA attestation standards, or by an equivalent practitioner under ISAE 3000 outside the United States. A Type 1 report addresses the design of controls as at a date; a Type 2 report covers how they operated over a period, typically six to twelve months.

There is no pass mark and no public register. The CPA firm gives an opinion and lists any exceptions, and the organisation shares the restricted-use report with clients and prospects, usually under a non-disclosure agreement. That is why it can stand in for individual client audits: each reader gets the same independent view.

How Sterling runs a programme like this

What follows describes how Sterling generally approaches a SOC 2 programme; it is not a record of this particular engagement. Every programme starts by agreeing the system in scope, the categories the clients need and the report type that fits their deadlines, followed by a gap analysis of the current controls against the criteria.

Organisations choose one of two alternative support levels. With Design™, our expert and experienced consultants develop the controls, policies and evidence plan and your team implements them under our advice and supervision. With Drive™, we design and build on your behalf, with your approval at each step, as a fully managed engagement.

Either way, Effivity, the GRC platform used in 50+ countries, holds the control set and the dated evidence, included with the engagement at no additional cost. The engagement can also cover internal auditor training for your audit team, as applicable to your standard.

SOC 2 for ITES and BPO providers: questions buyers ask