msmeyer
Posts: 5
Joined: Nov 2011
|
Thursday April 04, 2013 4:37 PM
|
|
SDCMO - I am not sure where you'd find that guidance. The only information I can offer to you is that each SOC1 report will include a section called something like "User Control Considerations" (I call them UCCs). In essence, this part of the report pretty much says that if the user of the services does not have those controls in place, it should not rely on the controls of the third party service provider. As such, part of my internal audit days consisted of going through the UCCs and making sure that they were covered with the already documented controls.
|
|
