Guide: Reporting on an Entity's Cybersecurity Risk Management Program and Controls, 2017


Book Description

Created by the AICPA, this authoritative guide provides interpretative guidance to enable accountants to examine and report on an entity's cybersecurity risk managementprogram and controls within that program. The guide delivers a framework which has been designed to provide stakeolders with useful, credible information about the effectiveness of an entity's cybersecurity efforts.




Guide


Book Description

Updated as of January 1, 2018, this guide includes relevant guidance contained in applicable standards and other technical sources. It explains the relationship between a service organization and its user entities, provides examples of service organizations, describes the description criteria to be used to prepare the description of the service organization’s system, identifies the trust services criteria as the criteria to be used to evaluate the design and operating effectiveness of controls, explains the difference between a type 1 and type 2 SOC 2 report, and provides illustrative reports for CPAs engaged to examine and report on system and organization controls at a service organization. It also describes the matters to be considered and procedures to be performed by the service auditor in planning, performing, and reporting on SOC 2 and SOC 3 engagements. New to this edition are: Updated for SSAE No. 18 (clarified attestation standards), this guide has been fully conformed to reflect lessons learned in practice Contains insight from expert authors on the SOC 2 working group composed of CPAs who perform SOC 2 and SOC 3 engagements Includes illustrative report paragraphs describing the matter that gave rise to the report modification for a large variety of situations Includes a new appendix for performing and reporting on a SOC 2 examination in accordance with International Standards on Assurance Engagements (ISAEs) or in accordance with both the AICPA’s attestation standards and the ISAEs




SOC for Supply Chain


Book Description

Internal and external forces such as globalization, global interconnectivity, automation, and other technological advancements are making today’s supply chains highly sophisticated and complex. For organizations that produce, manufacture or distribute products, there’s often a high level of interdependence and connectivity with their suppliers and their customers and business partners. Although the interconnectedness of these organizations can be beneficial (increased revenues, expanded market opportunities, and cost reduction), the ability of organizations to meet their goals is often increasingly dependent on events, processes, and controls that are not visible and are often beyond their control – such as a supplier’s controls. That’s why the demand for transparency in supply chains is now higher than ever before, and why this is the perfect time for you to help organizations assess their supply chain risks, evaluate the system controls within their manufacturing, production, or distribution systems, and communicate their supply chain management efforts to those with whom they do business. Accountants and financial managers can also increase the credibility of the supply chain information communicated by the organization by providing an opinion on the organization’s supply chain efforts. This guide enables the accountant and financial manager to examine and report on the description of a system for manufacturing, producing and distributing goods as well as on the controls within that system using a dynamic, proactive, and agile approach. It will show how to conduct this examination in accordance with the attestation standards. The guide may also be helpful when providing readiness assessments to clients, who are not quite ready for an examination level service and need help to get there. The guide also includes excerpts from the two distinct, but complementary sets of criteria developed by the AICPA to assist practitioners with SOC for Supply Chain engagements: the description criteria and the 2017 trust services criteria.




Research Anthology on Business Aspects of Cybersecurity


Book Description

Cybersecurity is vital for all businesses, regardless of sector. With constant threats and potential online dangers, businesses must remain aware of the current research and information available to them in order to protect themselves and their employees. Maintaining tight cybersecurity can be difficult for businesses as there are so many moving parts to contend with, but remaining vigilant and having protective measures and training in place is essential for a successful company. The Research Anthology on Business Aspects of Cybersecurity considers all emerging aspects of cybersecurity in the business sector including frameworks, models, best practices, and emerging areas of interest. This comprehensive reference source is split into three sections with the first discussing audits and risk assessments that businesses can conduct to ensure the security of their systems. The second section covers training and awareness initiatives for staff that promotes a security culture. The final section discusses software and systems that can be used to secure and manage cybersecurity threats. Covering topics such as audit models, security behavior, and insider threats, it is ideal for businesses, business professionals, managers, security analysts, IT specialists, executives, academicians, researchers, computer engineers, graduate students, and practitioners.




Encyclopedia of Organizational Knowledge, Administration, and Technology


Book Description

For any organization to be successful, it must operate in such a manner that knowledge and information, human resources, and technology are continually taken into consideration and managed effectively. Business concepts are always present regardless of the field or industry – in education, government, healthcare, not-for-profit, engineering, hospitality/tourism, among others. Maintaining organizational awareness and a strategic frame of mind is critical to meeting goals, gaining competitive advantage, and ultimately ensuring sustainability. The Encyclopedia of Organizational Knowledge, Administration, and Technology is an inaugural five-volume publication that offers 193 completely new and previously unpublished articles authored by leading experts on the latest concepts, issues, challenges, innovations, and opportunities covering all aspects of modern organizations. Moreover, it is comprised of content that highlights major breakthroughs, discoveries, and authoritative research results as they pertain to all aspects of organizational growth and development including methodologies that can help companies thrive and analytical tools that assess an organization’s internal health and performance. Insights are offered in key topics such as organizational structure, strategic leadership, information technology management, and business analytics, among others. The knowledge compiled in this publication is designed for entrepreneurs, managers, executives, investors, economic analysts, computer engineers, software programmers, human resource departments, and other industry professionals seeking to understand the latest tools to emerge from this field and who are looking to incorporate them in their practice. Additionally, academicians, researchers, and students in fields that include but are not limited to business, management science, organizational development, entrepreneurship, sociology, corporate psychology, computer science, and information technology will benefit from the research compiled within this publication.




Global Perspectives on Information Security Regulations: Compliance, Controls, and Assurance


Book Description

Recent decades have seen a proliferation of cybersecurity guidance in the form of government regulations and standards with which organizations must comply. As society becomes more heavily dependent on cyberspace, increasing levels of security measures will need to be established and maintained to protect the confidentiality, integrity, and availability of information. Global Perspectives on Information Security Regulations: Compliance, Controls, and Assurance summarizes current cybersecurity guidance and provides a compendium of innovative and state-of-the-art compliance and assurance practices and tools. It provides a synopsis of current cybersecurity guidance that organizations should consider so that management and their auditors can regularly evaluate their extent of compliance. Covering topics such as cybersecurity laws, deepfakes, and information protection, this premier reference source is an excellent resource for cybersecurity consultants and professionals, IT specialists, business leaders and managers, government officials, faculty and administration of both K-12 and higher education, libraries, students and educators of higher education, researchers, and academicians.




Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1)


Book Description

This updated and improved guide is designed to help accountants effectively perform SOC 1® engagements under AT-C section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting, of Statement on Standards for Attestation Engagements (SSAE) No. 18, Attestation Standards: Clarification and Recodification. With the growth in business specialization, outsourcing tasks and functions to service organizations has become increasingly popular, increasing the demand for SOC 1 engagements. This guide will help: Gain a deeper understanding of the requirements and guidance in AT-C section 320 for performing SOC 1 engagements. Obtain guidance from top CPAs on how to implement AT-C section 320 and address common and practice issues. Provide best in class services related to planning, performing, and reporting on a SOC 1 engagement. Successfully implement changes in AT-C section 320 arising from the issuance of SSAE 18, which is effective for reports dated on or after May 1, 2017. Determine how to describe the matter giving rise to a modified opinion by providing over 20 illustrative paragraphs for different situations. Understand the kinds of information auditors of the financial statements of user entities need from a service auditor's report. Implement the requirement in SSAE No. 18 to obtain a written assertion from management of the service organization. Organize and draft relevant sections of a type 2 report by providing complete illustrative type 2 reports that include the service auditor’s report, management’s assertion, the description of the service organization’s system, and the service auditor’s description of tests of controls and results. Develop management representation letters for SOC 1 engagements.




Audit Risk Alert


Book Description

This alert provides auditors with an overview of recent economic, industry, technical, regulatory, and professional developments that may affect how auditors conduct audits and other engagements. An entity’s internal management can also use this alert to address areas of audit concern. Updates include: Economic and Industry Developments Legislative and Regulatory Developments Audit and Attestation Issues and Developments Revenue Recognition New Lease Standard Accounting for Financial Instruments Recent AICPA Independence and Developments




Audit and Accounting Manual: Nonauthoritative Practice Aid, 2019


Book Description

This comprehensive, step-by-step guide provides a plain-English approach to planning and performing audits. In this handy resource, accountants and auditors will find updates for the issuance of SAS No. 132, The Auditor's Consideration of an Entity's Ability to Continue as a Going Concern, with illustrative examples, sample forms and helpful techniques ideal for small- and medium-sized firms Key Features include: Comprehensive and step-by-step guidance on the performance of an audit Numerous alerts that address the current-year developments in a variety of areas Illustrative examples and forms to facilitate hands-on performance of the audit




Audit Risk Alert: General Accounting and Auditing Developments 2018/19


Book Description

Containing descriptions of all recent auditing, accounting and regulatory developments, this 2018 alert will ensure that accountants have a robust understanding of the business, economic, and regulatory environments in which they and their clients operate. In addition, accountants will gain a full understanding of emerging practice issues, with targeted analysis of new developments and how they may affect their engagements, including: Recent Economic Trends Recent Legislative and PCAOB Developments Developments in Peer Review Recent Ethics Interpretations This useful resource also contains new accounting and auditing guidance related: Derivatives and Hedging Service Concession Agreements Discontinued Operations Stock Compensation