AICPA & CIMA

SOC reports remain the gold standard for managing third party risks that arise from doing business with a service organization. The SOC 2 guide, which provides guidance to service auditors on how to perform a SOC 2 examination, is currently being updated to better reflect the effect of new technologies and new methodologies on the SOC 2 examination. This session will provide a preview of some of the more significant changes being made to the guide.

Learning Objective:

Identify some of the more significant changes being made to the SOC2 guide.

Managing Third Party Risks: Introduction to Third-Party Assessment Programs

May 3, 2022 12:40pm ‐ May 3, 2022 1:30pm

Identification: TPR2202

An introduction for service auditors on how to provide third party risk assessment services. This session will define third party assessment programs, provide examples of such programs, and discuss some of the challenges working with specific third party assessment program bodies.

Learning Objective:

This session will identify third party assessment programs, examples of such programs, and recall some of the challenges working with specific third party assessment program bodies.

Understanding SOC and the SOC Suite of Services

May 3, 2022 2:00pm ‐ May 3, 2022 2:50pm

Identification: TPR2204

This introductory session will give an overview of the SOC suite of services, including how each SOC service addresses the needs of a specific set of users. It will also recognize the differences between each SOC service.

Learning Objectives:

Recognize the differences between each SOC service
Identify the SOC suite of services

Setting Up a SOC Practice

May 3, 2022 3:00pm ‐ May 3, 2022 3:50pm

Identification: TPR2206

This session, which is based on a new AICPA toolkit, will provide considerations for practitioners considering starting new SOC practices within their firms.

Learning Objective:

Identify considerations for practitioners considering starting new SOC practices.

Welcome to Day Two of the Conference: Opening Remarks | Evolving and Promoting CPA Technology Assurance and Advisory Services

May 4, 2022 11:30am ‐ May 4, 2022 12:30pm

Identification: TPR2208

Our Profession is continuously evolving to serve the public interest by developing high quality, value-added, innovative assurance and advisory solutions. The AICPA’s Assurance Services Executive Committee (ASEC) is responsible for addressing current market needs, particularly those that arise from the use of new and emerging technologies, through the development of new assurance and advisory solutions. This session will offer an inside look into ASEC, its areas of focus, current projects, and what’s on the horizon. It will also give an overview of ways in which other teams and committees across the AICPA and CIMA support these new assurance and advisory services.

Learning Objectives:

Recognize the mission and objectives of ASEC
Identify current projects and areas of focus under ASEC
Indicate future initiatives supporting professional services in this space

SOC1 Essentials

May 4, 2022 12:40pm ‐ May 4, 2022 1:30pm

Identification: TPR2210

For practitioners that are new to SOC 1 examinations this session addresses the basics, including:
- obtaining an understanding of the service organization's system and relevant controls
- determining whether control objectives are appropriate
- evaluating suitability of design
- evaluating operating effectiveness
- forming an opinion in the SOC 1 report

Learning Objectives:

Obtaining an understanding of the service organization's system and relevant controls
Distinguish whether control objectives are appropriate
Identify suitability of design
Identify operating effectiveness
Forming an opinion in the SOC 1 report

SOC2 Essentials

May 4, 2022 2:00pm ‐ May 4, 2022 2:50pm

Identification: TPR2212

For practitioner's that are new to SOC 2 examinations this session addresses the basics, including:
- obtaining an understanding of the service organization's system and relevant controls
- understanding how the trust services criteria relate to a service organization's system
- evaluating suitability of design
- evaluating operating effectiveness
- forming an opinion in the SOC 2 report

Learning Objectives:

Learn the trust services categories and related criteria
Distinguish the difference between a Type 1 and Type 2 report
Identify how to scope a SOC 2 engagement
Recognize the basics of SOC 2 testing
Recognize the service auditor's report

SOC 2 Challenges

May 4, 2022 2:00pm ‐ May 4, 2022 2:50pm

Identification: TPR2213

This session will highlight some of the more challenging topics that service auditors may encounter during a SOC 2 examination and provide guidance on how to address those topics in accordance with standards, including:

service commitment and system requirements
system boundaries and components
system incidents
user entity responsibilities
vendors and subservice organizations
evaluating results of procedures

Learning Objective:

Identify guidance on how to address challenging topics in accordance with standards

The Value of an Effective Vendor Risk Management Program

May 4, 2022 3:00pm ‐ May 4, 2022 3:50pm

Identification: TPR2214

Among other things, the pandemic has highlighted the importance of having effective processes and controls in place to manage supply chain issues. This session will explore some of the most important considerations to enable practitioners to assist their clients in the development of their vendor risk management programs.

Learning Objective:

Identify the most important considerations to enable practitioners to assist their clients in the development of their vendor risk management programs.

SOC for Supply Chain: Evaluating and Reporting on Risks

May 4, 2022 3:00pm ‐ May 4, 2022 3:50pm

Identification: TPR2215

Among other things, the pandemic has highlighted the importance of having effective processes and controls in place to manage supply chain issues. This session will present an overview of the SOC for Supply Chain reporting framework and how practitioners may use the framework to provide both Advisory and Attestation services to clients.

Learning Objective:

Identify the SOC for Supply Chain reporting framework and how practitioners may use the framework