Outsourcing is an inevitable phenomenon with most of the Fortune 1000 Companies. Many client organizations believe that there is a cost benefit to the Outsourcing engagements while there are some risks, however such can be mitigated. Client Management, Board of Directors and their auditors are specifically concerned with the risks involved in outsourcing and finding ways to gain assurance on the internal controls at the vendor operations.
With increased risks pertaining to Outsourcing, now many of the large clients in the US are making SSAE 16 (SOC 1, SOC 2 and SOC 3, Type 1 and 11 reports as a mandatory requirement either for procuring a new IT / BPO vendor or to renew the existing contracts with the current vendors.
Click below to see the benefits of SSAE 16 (SOC 1, SOC 2, SOC 3):
Benefits to Clients
Benefits to Service Provider Organizations
Benefits to Clients
Making SSAE 16 Reports available to your clients also offers great benefits to client audit teams and Board of Directors. A favorable /unqualified SSAE 16 report from the Service Organization/Vendor provides a detailed description of vendor organization's controls and an independent assessment from qualified CPAs of whether the controls were in operation, suitably designed for the outsourced process and whether such controls are operating efficiently.
As an added benefit, these reports are useful to Clients' auditors to assist them in the planning and audit of client's financial statements /Sarbanes-Oxley Audits. In majority of the cases, a favorable SSAE 16 report that is provided by the vendor on a timely basis would enhance the client's audit preparedness and most likely minimizes additional audits on vendor's controls and environments.
Benefits to Service Provider Organizations
Service Organizations/Vendors receive significant value from SSAE 16 Reports. An organization when it completes favorably SSAE 16 engagement it enables the CPAs to provide assurance on internal controls in the Organization and that the Organization has established effectively designed control objectives and activities. These assurances provided positively differentiates the organizations from its peers and builds trust with its clients and their regulators.
In most cases, a SSAE 16 Report will also satisfy many regulators by serving as a readily available, single source of information that has been independently verified by 3rd party auditors. Such audit / reports helps an organization from having to entertain multiple audit requests from various clients and their auditors, eliminating the strain on the organization's resources imposed by multiple audit visits.
As with increasing and strenuous external audits initiated by Sarbanes-Oxley 404 Audits, both clients and servicing organization would not want to undermine importance of appropriate and satisfactory audits that were conducted in adherence to AICPA and PCAOB standards. In addition, the SSAE 16 process often results in the identification of improvements in operational areas, making the organization more efficient.
A well scope and a successful SSAE 16 engagement could be best utilized as a competitive advantage in the outsourcing market. All other criteria being equal among vendors, at times the very fact that a particular vendor has presented an unqualified SSAE 16 Report over the others could be the distinguishing factor that could aid the client's to make a favorable decision to engage such vendor.