SOC Services

We help you become a better vendor.

In today’s connected business ecosystem, more and more organizations engage third parties to conduct key aspects of their operations. Because of the potential exposure, a growing number of firms view System and Organization Controls (SOC) reports as the price of admission for potential vendors.

At HORNE, we help you go beyond simply “checking all the boxes” and providing an unqualified report. We uncover opportunities to raise the bar on security, processes and practices. While our immediate focus is preparing you for or conducting your SOC report, our ultimate aim is to help you become a better vendor for your current customers and a more attractive choice for future ones.

Choosing the Right SOC Report for Your Organization

SOC reports provide management, auditors, business partners and executives with an objective analysis of your IT environment, and ensure them that transparency, accountability and controls are in place. For most organizations, the first challenge is defining the scope. HORNE helps you navigate the complexities and obtain the report that is appropriate for your needs.

SOC 1 Examinations:
Type 1 and Type 2

SOC 1 reports evaluate internal controls in relation to financial reporting. Service organizations may need a SOC 1 report if their provided service may have a material impact on the financial statements of the user entity, such as those that offer accounting software or payroll processing to user entities including loan servicing companies and medical claims processors.

SOC 2 Examinations:
Type 1 and Type 2

SOC 2 reports evaluate internal controls in relation to security, availability, processing integrity, confidentiality and privacy criteria. These typically are required of organizations that provide services that affect compliance and operational controls, such as data centers, server hosts and IT managed services providers.

SOC for

SOC for cybersecurity provides insights into your security posture and helps guide decisions that can drive board- or executive-level strategic cyber-resilience initiatives. This report demonstrates key strengths, vulnerabilities and opportunities of your IT environment, including:

  • Types of information and data at risk
  • Cybersecurity risk management program objectives
  • Factors that have a significant effect on inherent cybersecurity risks
  • Cybersecurity risk governance structure
  • Cybersecurity risk assessment processes
  • Monitoring of cybersecurity risk management program
  • Cybersecurity control processes


These reports help guide decision making and IT spending by outlining gaps in your organization’s cybersecurity risk management program.

The SOC Examination Process

While each SOC examination has its specific goals, the preparation is similar for all. Our SOC examination process includes:

b3lineicon|b3icon-head-idea||Head Idea

Identify your pain points, needs, wants, readiness and which SOC examination is appropriate for your organization.

b3lineicon|b3icon-list-add||List Add

Address control gaps, collect documentation and establish controls to ensure preparedness for the SOC examination.

b3lineicon|b3icon-user-network||User Network

Collaborate with stakeholders to analyze the critical activities and controls that could affect users of your system.

b3lineicon|b3icon-signed-document||Signed Document

Conduct quality control reviews to ensure that the work performed reflects the standards of the AICPA.

b3lineicon|b3icon-paper-plane||Paper Plane

We release a finalized report to you for designated users, upon receipt of a signed Management Representation letter.



Acceleration & Growth

HORNE’s acceleration and growth services help you stay ahead of the change with our technology, people, process and experience solutions.


Talk to an expert today.