Related Posts
Anonymous User
Excellent opportunities in Biological E limited
Position :Assistant Manager /Deputy Manager/ Manager.
Location: Hyderabad
Qualification:
CA completed with post Qualification 3 to 6 yrs experience .
Preferably Pharma and manufacturing industries experience is needed.
Job Description:
1. Strong in Indian Accounting standards grip (Ind AS)
2. Exposure on Audit handling like Big 4 companies
3. SAP exposure adv
Interested candidates can send resume to Kishore.dodda@biologicale.com
More Posts
Does IBM have good onsite opportunities?
Additional Posts in Risk Assurance
Coach
New to Fishbowl?
Download the Fishbowl app to
unlock all discussions on Fishbowl.
unlock all discussions on Fishbowl.
SOX is a law that requires that public companies (companies traded on the stock market) be audited by an external entity (e.g., a big four firm, any other audit firm) every year to ensure that the company’s financial statements are accurate. In a SOX audit, there is the financial statement audit (done by the assurance team) and the IT audit (done by the IT team). Both teams work together. The goal is to obtain reasonable assurance that whatever the company reported to the public on their financial statements was accurate.
SOC is a report that is published by an organization that provides services to other companies. For example, UltiPro is a HR and payroll application that is a cloud based application (it can be accessed over the web). A company can buy UltiPro to use in their organization. However, since UltiPro is cloud based, the application is hosted by UltiPro, therefore the company that buys the application cannot host it on their own servers. In order to ensure that UltiPro has proper controls/security in place to protect the company’s data, they go through a SOC audit. A third party auditor (e.g., a big four or other audit firm) will audit the applications controls. After the auditor reviews the controls, they publish a report to give an opinion on the security controls in place. This report can then be reviewed by every company that buys the software to ensure that their data is protected and safe.
I’m not sure what your experience is but hopefully this makes sense. SOC takes a little bit of background/research to grasp its importance. There’s also multiple types of SOC reports but I won’t get into that.
SOX refers to Sarbanes Oxley, which is legislation that details the requirements for all U.S. public companies.
SOC is System and Organization Controls which is AICPA speak for the reports produced from an audit.
To add on:
When people say SOX they're usually referring to either internal or external audits (of controls over financial reporting).
When people refer to SOC, they mean the attestation/report (that we read or produce) for companies who perform business to business services (I.e. service organizations)
A SOC can also refer to a Security Operations Center
I doubt this person is confused as to the difference between a Security Operations Center and Sarbanes Oxley.
A SOC report is issued by an independent auditor. A SOC report is typically used to demonstrate to clients and investors that your key business processes / services have suitable controls designed and operating effectively.
Mentor
SOX is utilized by the CIA for enhanced interrogation
Google is going to be your friend.
Goodness this was all so incredibly helpful. I know as a new hire I really look for mentoring so if anyone has any advice or insight they’d like to share, feel free to message me! Always looking to learn - thank you all again so much
One more thing I didn't see touched on- SOC and SOX clients both mostly involve controls testing so the work can be similar. SOC testing will be all IT controls (since the purpose is to attest to the system as a service is being operated effectively), while SOX will have both IT and business process controls (since the purpose is to attest the financial statements are not materially misstated). The IT controls in SOX and SOC should be similar enough someone could be on both types of engagements, especially at a staff level.
SOC is NOT all IT controls. This is an all too common misconception with SOC reports.