Beyond the Checklist - The Strategic Value of SOC Reports Webinar

To provide CPAs and other finance professionals with a practical understanding of SOC reports and third-party risk management, enabling them to evaluate vendor controls, interpret SOC report findings, and strengthen organizational oversight of outsourced services and emerging technology risks.

• Modern control challenges:
  – Third-party software
  – Critical operations outside company walls
  – Why vendor controls matter
• SOC report landscape:
  – Understanding different report types
  – Knowing which report to request
• Evaluating SOC reports:
  – Understanding structure
  – Auditor’s opinion
  – Complementary User Entity Controls (CUECs)
  – Subservice organizations (CSOCs)
• AI implementation and practical steps to reduce risk

Faten AlKhattar, Director, Citrin Cooperman Advisors LLC

To provide CPAs and other finance professionals with a practical understanding of SOC reports and third-party risk management, enabling them to evaluate vendor controls, interpret SOC report findings, and strengthen organizational oversight of outsourced services and emerging technology risks.

DETAILED LEARNING OBJECTIVES

• Explain the role of SOC reports in third-party risk management and vendor oversight

• Differentiate among SOC 1, SOC 2, SOC 3, and SOC for Cybersecurity reports

• Identify the appropriate SOC report to request based on specific business and assurance needs

• Describe the key sections of a SOC report and their purpose

• Evaluate auditor opinions, exceptions, and control testing results within SOC reports

• Recognize the importance of Complementary User Entity Controls (CUECs) and subservice organizations

• Apply professional judgment when relying on SOC reports for risk management and assurance purposes

• Assess emerging risks associated with AI-enabled vendor environments and the limitations of existing SOC reporting

• Modern control challenges:
  – Third-party software
  – Critical operations outside company walls
  – Why vendor controls matter
• SOC report landscape:
  – Understanding different report types
  – Knowing which report to request
• Evaluating SOC reports:
  – Understanding structure
  – Auditor’s opinion
  – Complementary User Entity Controls (CUECs)
  – Subservice organizations (CSOCs)
• AI implementation and practical steps to reduce risk

Faten AlKhattar, Director, Citrin Cooperman Advisors LLC