SOC 2 Auditor Red Flags

WEBVTT
00:00:00.000 --> 00:00:02.899
Welcome to Compliance Pointers, where we take
00:00:02.899 --> 00:00:05.780
an in -depth look into the latest news, trends,
00:00:06.019 --> 00:00:08.439
and challenges surrounding information security,
00:00:08.839 --> 00:00:12.320
privacy, and marketing compliance. Let's dive
00:00:12.320 --> 00:00:15.460
in with your host, Jordan Eisner. Hello, and
00:00:15.460 --> 00:00:18.239
welcome to another episode of Compliance Pointers,
00:00:18.440 --> 00:00:23.100
sponsored by Compliance Point. And with me once
00:00:23.100 --> 00:00:26.160
again, it's been a little while, Carol, but it's
00:00:26.160 --> 00:00:30.120
Carol Amick. Managing director here at Compliance
00:00:30.120 --> 00:00:35.200
Point. Utility player, I would say, but primarily
00:00:35.200 --> 00:00:39.079
focused these days on SOC 2 attestations. She
00:00:39.079 --> 00:00:43.100
is a CPA. She's been with Compliance Point. It's
00:00:43.100 --> 00:00:47.380
got to be getting close to a decade, right? Or
00:00:47.380 --> 00:00:49.619
am I way over true? Nine years or so, yeah. Nine
00:00:49.619 --> 00:00:53.079
years or so, yeah. Basically built our high trust
00:00:53.079 --> 00:00:57.020
practice. A lot of experience there. Prior to
00:00:57.020 --> 00:01:01.880
that, in -house stints, external consulting stints
00:01:01.880 --> 00:01:05.439
all around HIPAA and compliance and many other
00:01:05.439 --> 00:01:09.299
things. So a wealth of information on audits
00:01:09.299 --> 00:01:13.079
and compliance. And so a very, very good guess
00:01:13.079 --> 00:01:18.519
for our topic today in light of the recent Delve
00:01:18.519 --> 00:01:24.340
findings, right? And I don't know what you'd
00:01:24.340 --> 00:01:31.079
call it. report breaking news leak so obviously
00:01:31.079 --> 00:01:34.819
it's obviously at least a security breach because
00:01:34.819 --> 00:01:38.799
the people seem to be in their system yes yes
00:01:38.799 --> 00:01:43.280
so uh really shed some light on i don't want
00:01:43.280 --> 00:01:45.200
to say the state of the industry i think that's
00:01:45.200 --> 00:01:50.219
a bridge too far but maybe the importance of
00:01:50.219 --> 00:01:54.909
scrutiny on these auditors and peer reviews And,
00:01:54.909 --> 00:01:58.629
you know, who's watching the hen house and ensuring
00:01:58.629 --> 00:02:01.989
it's not the fox? Yeah, I mean, there has been
00:02:01.989 --> 00:02:04.129
this is not the first allegation we've heard
00:02:04.129 --> 00:02:08.030
that you sock in a box, as it's referred to.
00:02:08.050 --> 00:02:10.110
You can get a sock in a box and it's quick and
00:02:10.110 --> 00:02:12.750
it's easy. Anytime you're getting a certification,
00:02:12.969 --> 00:02:15.629
if the word's quick and easy or used, that's
00:02:15.629 --> 00:02:19.830
probably a red flag right there. Right. So, look,
00:02:19.969 --> 00:02:23.680
let's, you know. So expand on it, Carol. You've
00:02:23.680 --> 00:02:25.500
seen it. I'm sure our audience and listeners
00:02:25.500 --> 00:02:32.259
have seen it. What all did we find out? So, you
00:02:32.259 --> 00:02:33.419
know, there are a couple of things that come
00:02:33.419 --> 00:02:37.819
out on this. One is Delve advertised that you
00:02:37.819 --> 00:02:41.460
could get. a SOC audit, and they're not the only
00:02:41.460 --> 00:02:43.139
ones. I guess I shouldn't use them by name because
00:02:43.139 --> 00:02:45.139
I've seen this with other places, and I've actually
00:02:45.139 --> 00:02:47.879
talked to our clients who, you know, will tell
00:02:47.879 --> 00:02:50.919
me, I talked to so -and -so, and they can get
00:02:50.919 --> 00:02:53.199
me a SOC audit in a month, and I don't have to
00:02:53.199 --> 00:02:55.639
do anything, and, you know, it'll be easy. They're
00:02:55.639 --> 00:02:57.180
just going to use this tool, and it's going to
00:02:57.180 --> 00:03:01.139
create a thing. That's the first red flag right
00:03:01.139 --> 00:03:06.479
there. A SOC audit requires that you design your
00:03:06.479 --> 00:03:11.680
controls. So if they're doing that for you, how
00:03:11.680 --> 00:03:13.240
do you even know what the controls are? I mean,
00:03:13.259 --> 00:03:16.479
the AICPA does give me a template and some suggested
00:03:16.479 --> 00:03:20.139
controls, but it's not this is what you have
00:03:20.139 --> 00:03:22.759
to do. You just have to cover that risk that's
00:03:22.759 --> 00:03:25.300
related to the trust service criteria. So these
00:03:25.300 --> 00:03:28.300
are the suggestions. For example, they have controls
00:03:28.300 --> 00:03:31.680
on independence on the board of directors, how
00:03:31.680 --> 00:03:33.300
often the board meets, that kind of thing. If
00:03:33.300 --> 00:03:35.860
you are a privately held company, you may not.
00:03:36.110 --> 00:03:38.569
even need to comply with that particular common
00:03:38.569 --> 00:03:41.669
criteria of the trust service criteria. So, you
00:03:41.669 --> 00:03:43.770
know, you should have been tailoring these to
00:03:43.770 --> 00:03:46.349
fit your environment and your operations. And
00:03:46.349 --> 00:03:50.909
that's not going to happen in a couple of days.
00:03:51.030 --> 00:03:53.770
I mean, so that's your first sign. We can get
00:03:53.770 --> 00:03:54.909
this to you in a couple of weeks. You'll have
00:03:54.909 --> 00:03:59.650
it for your clients. How can it be custom and
00:03:59.650 --> 00:04:02.409
tailored to our business in such a short amount
00:04:02.409 --> 00:04:04.849
of time? You know nothing about us. Mm -hmm.
00:04:06.209 --> 00:04:08.430
And so I think the other thing to think about
00:04:08.430 --> 00:04:10.710
is, you know, are they offering to get you certifications
00:04:10.710 --> 00:04:14.430
that don't exist? One of the things that a lot
00:04:14.430 --> 00:04:15.909
of these firms offer is a HIPAA certification.
00:04:15.909 --> 00:04:18.470
And Jordan will tell you the account executives
00:04:18.470 --> 00:04:20.110
that compliance might have come to me and said,
00:04:20.170 --> 00:04:23.750
can we can we certify HIPAA? No, because there
00:04:23.750 --> 00:04:26.329
is no such thing. And as a matter of fact, I
00:04:26.329 --> 00:04:28.069
think it's the Federal Trade Commission has said
00:04:28.069 --> 00:04:29.949
if you advertise a HIPAA certification on your
00:04:29.949 --> 00:04:32.980
Web site, that is. basically false advertising
00:04:32.980 --> 00:04:35.540
because the government has never authorized the
00:04:35.540 --> 00:04:38.779
HIPAA certification. So we don't issue HIPAA
00:04:38.779 --> 00:04:41.939
certification. So if your firm that's working
00:04:41.939 --> 00:04:44.000
with you is giving you certifications that don't
00:04:44.000 --> 00:04:46.399
really exist and telling you we're going to certify
00:04:46.399 --> 00:04:49.220
you as HIPAA compliant, how are they doing that?
00:04:49.540 --> 00:04:53.819
Yeah. We do, however, issue opinion letters.
00:04:54.019 --> 00:04:56.519
Yeah. I will audit you against it. We will audit
00:04:56.519 --> 00:05:00.800
you against the... We can even include those
00:05:00.800 --> 00:05:02.779
in a SOC audit. We have a client right now. I'm
00:05:02.779 --> 00:05:05.680
doing a SOC audit that includes HIPAA. So we
00:05:05.680 --> 00:05:08.319
can give you an audited report that shows you
00:05:08.319 --> 00:05:11.100
that you are compliant with the laws and the
00:05:11.100 --> 00:05:13.519
regulations. That's not a problem, but we aren't
00:05:13.519 --> 00:05:15.279
going to then call you HIPAA compliant because
00:05:15.279 --> 00:05:17.699
that certification doesn't exist. So that's part
00:05:17.699 --> 00:05:20.160
of the registration that you, you know, I've
00:05:20.160 --> 00:05:23.639
been advertising that. And I think the big thing
00:05:23.639 --> 00:05:26.009
is. Are they telling you there's no effort on
00:05:26.009 --> 00:05:27.889
your side? Because if they are, how are they
00:05:27.889 --> 00:05:29.709
getting their data? How are they getting their
00:05:29.709 --> 00:05:31.709
information? I know we're in an age where you
00:05:31.709 --> 00:05:33.889
can get a lot out of AI and you can get a lot
00:05:33.889 --> 00:05:38.230
out of automation. But there's still things in
00:05:38.230 --> 00:05:42.069
those audits that are not automated. The first
00:05:42.069 --> 00:05:44.250
service criteria includes controls related to
00:05:44.250 --> 00:05:45.769
governance. We talked about board of directors.
00:05:45.910 --> 00:05:49.069
There's some other ones. Personnel. And a lot
00:05:49.069 --> 00:05:52.470
of that is not always automated. So you want
00:05:52.470 --> 00:05:55.350
to know, you know, How are they getting there
00:05:55.350 --> 00:05:57.269
if they can do it without any input from you?
00:05:58.310 --> 00:06:00.769
It raises some red flags. And then I'm just going
00:06:00.769 --> 00:06:03.810
to bring up one that I saw a very interesting
00:06:03.810 --> 00:06:06.569
LinkedIn post from somebody who was hired to
00:06:06.569 --> 00:06:11.189
do a peer review on a firm that was doing SOC
00:06:11.189 --> 00:06:15.310
audits and saw that the firm was able to do a
00:06:15.310 --> 00:06:19.870
SOC audit for about $2 ,000. Now, let's say your
00:06:19.870 --> 00:06:22.339
average SOC audit has... somewhere in the range
00:06:22.339 --> 00:06:24.579
of 80 to 100 controls. So let's say 100 controls.
00:06:24.740 --> 00:06:27.540
That's what, $20 of control for your CPA firm
00:06:27.540 --> 00:06:31.720
to look at the auditor? I mean, that's, how much
00:06:31.720 --> 00:06:35.139
work do you think they're putting in? And that
00:06:35.139 --> 00:06:37.160
would just, it sounds too, you know, and they
00:06:37.160 --> 00:06:39.000
say a lot, but it sounds too good to be true.
00:06:39.279 --> 00:06:43.139
It probably is. If your CPA firm can do the work
00:06:43.139 --> 00:06:46.600
for that, the question is, what are you getting?
00:06:46.680 --> 00:06:49.779
Because, yeah. I mean, you know, I feel like
00:06:49.779 --> 00:06:52.060
I'm not one of the most expensive CPA firms in
00:06:52.060 --> 00:06:53.740
the world, and I certainly wouldn't do an audit
00:06:53.740 --> 00:06:59.939
for $2 ,000. Yeah, $20 a control. And that's
00:06:59.939 --> 00:07:03.660
what, five minutes max? Yeah, so yeah. I think
00:07:03.660 --> 00:07:06.000
that's the other thing. So, you know, I know
00:07:06.000 --> 00:07:08.439
it sounds promising when you get this quick fix
00:07:08.439 --> 00:07:10.360
and you've got somebody breathing down your report,
00:07:10.680 --> 00:07:13.490
but there are ways to get around that. I think,
00:07:13.490 --> 00:07:15.470
Jordan, we can talk, you know, we've done, we
00:07:15.470 --> 00:07:17.990
do SOC 2 type 1s, which is where we show your
00:07:17.990 --> 00:07:20.350
client that, look, you've identified your controls.
00:07:20.649 --> 00:07:22.550
Here's the controls you're implementing. Here's
00:07:22.550 --> 00:07:25.170
where you are. We're on the road. We're on the
00:07:25.170 --> 00:07:27.370
progress. You can get those very quickly. We
00:07:27.370 --> 00:07:30.050
do those, you know, in a month or so. They don't,
00:07:30.050 --> 00:07:31.629
you know, they're not showing that you've got
00:07:31.629 --> 00:07:33.569
everything implemented. But a lot of people do
00:07:33.569 --> 00:07:36.329
do that as the first step to show their clients,
00:07:36.449 --> 00:07:38.949
look, you want a SOC. We're on the road. Here's
00:07:38.949 --> 00:07:40.870
where we are. And in three months, we'll have
00:07:40.870 --> 00:07:43.100
a SOC 2. But, you know, we're giving you a report.
00:07:43.259 --> 00:07:45.040
We've hired a firm. Here's what we're doing.
00:07:45.740 --> 00:07:48.439
But I also think the other part of this is the
00:07:48.439 --> 00:07:51.139
people reading the audits need to start, you
00:07:51.139 --> 00:07:52.839
know, thinking about whether they make sense,
00:07:52.939 --> 00:07:56.160
whether it looks like they make sense. Okay.
00:07:57.040 --> 00:07:59.819
So I know we were going to talk about Delve a
00:07:59.819 --> 00:08:01.439
little bit. We've covered that. And then we were
00:08:01.439 --> 00:08:02.680
getting the red flags. But it sounds like you're
00:08:02.680 --> 00:08:04.879
already starting to cover. We dove right in.
00:08:04.899 --> 00:08:07.519
No, that's fine. You know, it will be quick hitters
00:08:07.519 --> 00:08:09.360
for the listeners today. And we can wrap early.
00:08:09.420 --> 00:08:13.410
But, you know. price and the lower it is the
00:08:13.410 --> 00:08:15.889
more it should be a red flag time the shorter
00:08:15.889 --> 00:08:18.589
it is the more there should be a red flag um
00:08:18.589 --> 00:08:22.410
what else your involvement i think that's another
00:08:22.410 --> 00:08:25.870
key were you involved did you i mean did you
00:08:25.870 --> 00:08:28.029
just hire this company and a month later you
00:08:28.029 --> 00:08:31.500
have a report Or two weeks later. That's a red
00:08:31.500 --> 00:08:34.080
flag because there should have been stuff that
00:08:34.080 --> 00:08:36.139
you had to explain to your client, to your auditor
00:08:36.139 --> 00:08:38.220
about how things worked. I mean, because it's
00:08:38.220 --> 00:08:40.840
just, I never pretend I can go into a system
00:08:40.840 --> 00:08:42.679
and understand it. Everybody sets their system
00:08:42.679 --> 00:08:44.559
up differently. Everybody does things differently,
00:08:44.860 --> 00:08:48.460
documents things differently. And so, you know,
00:08:48.559 --> 00:08:51.360
were you ever asked to explain anything? Because
00:08:51.360 --> 00:08:54.279
if you weren't, that's probably not a great sign.
00:08:55.179 --> 00:08:57.820
We meet with our clients when they're in SOC
00:08:57.820 --> 00:09:00.429
once a week. um just to make sure we understand
00:09:00.429 --> 00:09:02.870
and also to make sure they understand our request
00:09:02.870 --> 00:09:07.129
you know if we ask for something i speak audit
00:09:07.129 --> 00:09:09.269
i know that so you know you may not really know
00:09:09.269 --> 00:09:10.929
exactly what i want you don't wish you waste
00:09:10.929 --> 00:09:13.149
your time throwing stuff back at me um and so
00:09:13.149 --> 00:09:14.990
you should have been communicating with your
00:09:14.990 --> 00:09:16.549
auditor there should have been questions that
00:09:16.549 --> 00:09:18.710
you had to answer for them over the course of
00:09:18.710 --> 00:09:22.039
your audit Even if you are using a tool. I mean,
00:09:22.039 --> 00:09:24.120
a lot of our clients use some great GRC tools
00:09:24.120 --> 00:09:26.539
that we can just get data out of and do testing
00:09:26.539 --> 00:09:28.759
out of and look at. But there's still going to
00:09:28.759 --> 00:09:30.759
be some questions, you know, even in that case.
00:09:30.940 --> 00:09:32.919
How can you snuff out some of that beforehand?
00:09:33.200 --> 00:09:36.820
Let's say that the price looks good. Or sorry,
00:09:36.919 --> 00:09:40.039
the price is very attractive because it's so
00:09:40.039 --> 00:09:42.500
low. The time to do it is very attractive because
00:09:42.500 --> 00:09:46.639
it's so low. you know, the auditor is painting
00:09:46.639 --> 00:09:48.220
a picture that, you know, they're going to be
00:09:48.220 --> 00:09:50.019
requesting certain information from you. So probably
00:09:50.019 --> 00:09:54.220
too good to be true. How can you trust but verify
00:09:54.220 --> 00:09:56.679
that before you enter into contract with them
00:09:56.679 --> 00:10:00.480
to do it? I think you've got to use some skepticism.
00:10:00.659 --> 00:10:02.279
I think the other thing is to make sure your
00:10:02.279 --> 00:10:04.539
CPA firm is registered. There's a website called
00:10:04.539 --> 00:10:07.440
CPA Verify that you can go on and look up your
00:10:07.440 --> 00:10:11.139
CPA firm. You can also go on the AICPA peer review
00:10:11.139 --> 00:10:13.360
website and see if they're enrolled in the peer
00:10:13.360 --> 00:10:16.419
review. And that is, I think, one of the things
00:10:16.419 --> 00:10:18.080
that has come out about some of these firms is
00:10:18.080 --> 00:10:20.100
they are not doing peer reviews. They are not
00:10:20.100 --> 00:10:23.899
enrolled in the peer review process. just google
00:10:23.899 --> 00:10:26.899
search um you know the auditor the cpa's name
00:10:26.899 --> 00:10:29.120
you know where do they that they have credential
00:10:29.120 --> 00:10:31.840
i mean i have an audit report that one of our
00:10:31.840 --> 00:10:35.259
clients got that they rejected because when they
00:10:35.259 --> 00:10:38.980
got it it was signed by a cpa who wrote well
00:10:38.980 --> 00:10:42.919
not really a cpa a young person who wrote on
00:10:42.919 --> 00:10:44.840
there that they were sitting for the exam next
00:10:44.840 --> 00:10:49.539
month now They weren't even technically a CPA
00:10:49.539 --> 00:10:51.559
because it's not just the exam. There's also
00:10:51.559 --> 00:10:53.519
an experience requirement. And when she went
00:10:53.519 --> 00:10:55.600
on Google, when you linked in and looked up this
00:10:55.600 --> 00:10:57.960
young person, it was a young man, they were still
00:10:57.960 --> 00:11:01.200
in school. So, you know, they're getting paid
00:11:01.200 --> 00:11:07.259
a fee to sign these reports. But a little research
00:11:07.259 --> 00:11:09.759
might have shown this probably wasn't a CPA firm
00:11:09.759 --> 00:11:12.320
you should be picking yourself up with. That's
00:11:12.320 --> 00:11:19.000
quite shady. And we set up our firm that does
00:11:19.000 --> 00:11:21.080
the audits. You know, we went through a lot of
00:11:21.080 --> 00:11:23.399
hoops to prove that I had the skills and the
00:11:23.399 --> 00:11:25.659
expertise. So that's another background, just
00:11:25.659 --> 00:11:27.480
to make sure there's a firm that's registered
00:11:27.480 --> 00:11:30.440
legitimately. There were some lists of some of
00:11:30.440 --> 00:11:31.779
these, and I've looked some of them up, and some
00:11:31.779 --> 00:11:33.279
of them are registered, and some of them are
00:11:33.279 --> 00:11:35.419
probably legit. And a couple of them, I'm like,
00:11:35.559 --> 00:11:39.179
who is this? I can't even find them. So, yeah.
00:11:40.659 --> 00:11:44.940
Okay. I mean, you can always ask for references,
00:11:45.039 --> 00:11:47.559
too. Yeah, they're going to give you good ones,
00:11:47.600 --> 00:11:51.419
though. At this point, I think some people are
00:11:51.419 --> 00:11:53.779
starting to get suspicious. And so you could
00:11:53.779 --> 00:11:55.379
easily have somebody say, yeah, we have one.
00:11:55.840 --> 00:11:58.799
I mean, we have acquired clients that way who
00:11:58.799 --> 00:12:01.240
said, yeah, we did an audit with somebody and
00:12:01.240 --> 00:12:06.080
it wasn't good. And we're starting over. And
00:12:06.080 --> 00:12:08.299
so, you know, if you kind of run into that, you
00:12:08.299 --> 00:12:10.779
can kind of find that out there. That's your
00:12:10.779 --> 00:12:15.000
peers. Okay. That was a quick list, but it was
00:12:15.000 --> 00:12:21.419
a good list. Anything we didn't cover? You know,
00:12:21.460 --> 00:12:24.200
I feel like a lot of people know when they sign
00:12:24.200 --> 00:12:26.759
these that this is a little iffy. I can have
00:12:26.759 --> 00:12:29.379
a soccer port. And the other side of this, I
00:12:29.379 --> 00:12:34.480
would say, is if you are the company buying the
00:12:34.480 --> 00:12:37.740
service and you say to them, do you have a soccer
00:12:37.740 --> 00:12:39.990
port? Do you have a sock? Can I see it? And they
00:12:39.990 --> 00:12:41.889
say no. And they then call you and say, but I'll
00:12:41.889 --> 00:12:46.870
have it by next week. Or even the next month.
00:12:46.950 --> 00:12:49.870
That alone should be like, wait, what are you
00:12:49.870 --> 00:12:52.789
giving me? Where is it coming from? Yeah, so
00:12:52.789 --> 00:12:56.830
organizations requiring the socks. Also, you
00:12:56.830 --> 00:12:59.990
know, this is a message for you too. I mean,
00:13:00.029 --> 00:13:05.789
if you don't have some flexibility in how they
00:13:05.789 --> 00:13:10.460
accomplish the sock too. and you're putting scrutiny
00:13:10.460 --> 00:13:12.299
and pressure on them to do as quick as possible
00:13:12.299 --> 00:13:15.019
and as cheap as possible, you could actually
00:13:15.019 --> 00:13:18.320
be putting your company at risk. If they want
00:13:18.320 --> 00:13:19.759
that business, they call you back and say, you
00:13:19.759 --> 00:13:20.980
know, we told you we didn't have something, but
00:13:20.980 --> 00:13:23.879
we got it this week. Okay, we talked to you a
00:13:23.879 --> 00:13:25.840
week ago and you didn't have it. So make sure
00:13:25.840 --> 00:13:29.500
there's checks and balances on your side. I think
00:13:29.500 --> 00:13:32.639
sometimes people, you know, procurement and stuff
00:13:32.639 --> 00:13:36.779
puts pressure on people. That's why I said work
00:13:36.779 --> 00:13:38.759
with them. If there's a product you really want,
00:13:38.820 --> 00:13:40.759
work with them to get it done the right way to
00:13:40.759 --> 00:13:43.799
protect you. Let's start with you doing a SOC
00:13:43.799 --> 00:13:45.720
1 where it's just listing out the controls so
00:13:45.720 --> 00:13:48.480
we can see what you're doing. Let's get you going
00:13:48.480 --> 00:13:51.360
down the road. Work with them, especially if
00:13:51.360 --> 00:13:53.100
it's a product you want and they want to do the
00:13:53.100 --> 00:13:56.220
right thing. You'll get a better product and
00:13:56.220 --> 00:13:59.600
you will be better protected than a check the
00:13:59.600 --> 00:14:02.330
box that didn't really check your box. That's
00:14:02.330 --> 00:14:03.750
a great point. I think that's a good one to end
00:14:03.750 --> 00:14:06.830
on. I will say to the listeners and viewers,
00:14:07.009 --> 00:14:08.690
if you have additional questions on this, if
00:14:08.690 --> 00:14:10.350
you're weighing options between auditors, if
00:14:10.350 --> 00:14:14.029
you're stuck in an audit where you're already
00:14:14.029 --> 00:14:15.710
starting to scratch your head and red flags are
00:14:15.710 --> 00:14:17.850
appearing, or you just want to bounce some ideas
00:14:17.850 --> 00:14:21.929
off an organization as you evaluate this and
00:14:21.929 --> 00:14:24.850
look at future SOC 2 aspirations, please don't
00:14:24.850 --> 00:14:26.870
hesitate to reach out to myself and or Carol.
00:14:27.690 --> 00:14:30.389
You can find us at compliancepoint .com and you
00:14:30.389 --> 00:14:32.250
can email us at connect at compliancepoint .com
00:14:32.250 --> 00:14:34.289
and we're both on LinkedIn that way. So not too
00:14:34.289 --> 00:14:37.029
hard to get in touch with. Until next time, everybody
00:14:37.029 --> 00:14:39.009
be well. And Carol, thank you for your time today.