SOC / SSAE Assessment
- Confirm the report your customers actually need
- Prepare your system description and evidence
- Receive your SOC 1 or SOC 2 report from QRC
SOC examinations performed by QRC, a CPA firm, under AICPA attestation standards (SSAE).
Who Needs a SOC / SSAE Assessment?
Service organizations whose customers rely on their controls may be asked for a SOC 1 or SOC 2 report, including:
SaaS and Cloud Service Providers
Data Center and Hosting Providers
Payroll, Billing and Payment Processors
BPO and Shared Service Providers
Fintech and Financial Service Providers
Vendors Facing Customer Security Questionnaires
Our SOC / SSAE Assessment Approach
A structured path from report selection and readiness through QRC's examination and report issuance.
Deliverables You Can Expect
Reports and working outputs aligned with AICPA SOC reporting requirements.
SOC Scope & Report Type Recommendation
Readiness Assessment Report
System Description Review
SOC 1 Report (Type I or Type II)
SOC 2 Report (Type I or Type II)
Testing Results & Exceptions Summary
Benefits of a SOC / SSAE Assessment
Answer Customer Due Diligence
One report answers many recurring customer security and control questionnaires.
Support Customer Audits
SOC 1 reports help customers' auditors rely on your controls over financial reporting.
Demonstrate Operating Controls
Type II reports show controls worked over time, not only on one date.
Shorten Sales Cycles
A current SOC 2 report can remove a common blocker in enterprise deals.
Stronger Control Discipline
Annual assessment cycles build consistent evidence and ownership across teams.
Reusable Evidence
Evidence can support related frameworks such as ISO/IEC 27001 and CSA STAR.
Why Service Organizations Choose QRC
SOC examinations performed by a CPA firm with multi-framework audit experience.
QRC performs the SOC examination and issues your SOC report.
Listed by CSA to perform SOC 2 plus CCM STAR Attestation.
Audit experience across SOC, ISO/IEC 27001, PCI DSS and CSA STAR.
Clear scoping, readiness, testing and reporting milestones.
Supporting Services
Services that complement your SOC / SSAE assessment program.
CSA STAR Attestation
Extend a SOC 2 examination with the Cloud Controls Matrix for STAR Level 2.
Learn More
ISO/IEC 27001 Certification
Accredited ISMS certification that many customers request alongside a SOC 2 report.
Learn More
Penetration Testing
Independent testing that provides evidence for SOC 2 security and vulnerability controls.
Learn MoreFrequently Asked Questions
SOC 1 reports on controls relevant to your customers' internal control over financial reporting. SOC 2 reports on controls relevant to security, availability, processing integrity, confidentiality or privacy, using the AICPA Trust Services Criteria.
A Type I report covers the design of controls at a point in time. A Type II report also tests whether controls operated effectively over a period, commonly 3 to 12 months.
Yes. QRC is a CPA firm and performs SOC examinations under the AICPA's Statements on Standards for Attestation Engagements (SSAE). QRC issues the resulting SOC 1 or SOC 2 report.
Security is required in every SOC 2 examination. Availability, processing integrity, confidentiality and privacy are added when they matter to your customers and services.
Many customers expect a current report each year, so Type II reports are often renewed every 12 months. The review period is agreed during scoping.
Ready to Start Your SOC / SSAE Assessment?
Get the right report type, clear scope and a structured path to issuance.