The Cost of An SSAE 16 SOC 1 Report is No Mystery
Cost Factors of an SSAE 16 Report
One of the first questions we get whenever someone asks about an SSAE 16 SOC 1 report is this: How much does the engagement and accompanying report cost? If you’ve been asked by one of your clients to produce an SSAE 16 report, you are probably wondering the same.
The SSAE 16 SOC 1 report is officially called the Report on Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting. That is a long name that describes what is actually a pretty straightforward report—one designed to assure your clients and stakeholders that your service business has systems (called IT general controls and controls in accounting) in place to protect their sensitive data and/or financial transaction information and to attest to their operating effectiveness.
The transactions we are talking about for an SSAE 16 report are those that are central to your business. For example, if you run an employee benefits business that could include escrow accounts and processing payments. If you run a tax processing business that could include the processes of collecting and disbursing money and how tax payments are made.
In an SSAE 16 report we look at several elements of each transaction:
- Initiation of the process
- How it is authorized
- How the process is recorded and logged
- Security measures
- Accuracy of the processing
- Timeliness of conducting the processing
The financial cost of an SSAE 16 report varies depending on many factors. Let’s look at the five primary factors that affect the cost of an SSAE 16 report:
- Type of business. Some service businesses are more complex than others and have more internal controls or are impacted by regulatory requirements.
- Number of locations of the business. We are required to review the main office of a business, as well as offices or facilities that house computer servers involved in the service the organization provides. That may involve traveling domestically or internationally, depending on the business.
- Number of employees. We are required to report on everyone who comes in contact with the transactions, and anyone with access to the data or the money, to ensure a proper separation of duties.
- Number of applications. We are required to report on the internal controls for each type of transaction that impacts your clients’ financial information. We test a sample of all transactions the business conducts in one year, so the more applications you have that are subject to internal control requirements, the more we have to test.
- Your deadline. Typical time it takes to produce an SSAE 16 SOC 1 report is six (6) to eight (8) weeks. It is possible to produce a report faster (in as little as 3 weeks, but that is a little more expensive than a report delivered in a standard timeframe.
So for a U.S. or Canada-based service organization, with one or two locations and 25 to 200 employees that provides one, two, or maybe three standard services for their customers, you would be looking at roughly our base pricing, which we are one of the first, if not the first, to provide fixed prices for an audit assurance engagement.
The fee will be higher for larger businesses with thousands of employees, hundreds of processes, and dozens of locations. And the cost could be potentially less for smaller businesses, with just a few employees and processes, operating out of one location. One thing to keep in mind when relating to an organization with just a few employees though; with very few employees, many controls can be blurred and have to be sorted out, which an engagement of this nature can prove to be more involved than an organization with 50 employees and clear job descriptions and departments with clear cut internal controls and separation of duties.
Regardless of the factors the affect the pricing of your engagement, we are very experienced at producing SSAE SOC 1 reports. In fact, our clients have told us that the process was much smoother than they anticipated. Clients have told us that they were expecting an experience like a root canal, and they were pleasantly surprised to experience something far less inconvenient.
Streamlined SSAE 16 Report Process
We have the SSAE 16 SOC 1 report process streamlined to a T and pride ourselves on the ability to service clients while also getting to know them as individuals and businesses. Each SSAE 16 SOC 1 Audit engagement we perform proceeds smoothly through each of the 5-7 phases of the engagement. Our efficiency is grounded in the fact that we do not use contractors. Rather, we have the ability to provide the same Audit Team from start to finish on all phases of an engagement, which allows us to understand our client’s operations, not just audit them. And at the end of the day providing valued added guidance and recommendations to our clients, not just auditing them, is what’s most important to us at Auditwerx.
If you have any questions about the cost of conducting an SSAE 16 SOC 1 internal controls audit, please feel free to ask them in the comments below, or for a personalized quote, please email us your relevant information to firstname.lastname@example.org