What Magneto's Helmet and Non-ICFR SSAE 16 Controls have in Common


Both are designed to mitigate unlikely risks.  For anyone who may not know, Magneto's nemesis, Professor X, has the ability to read minds, and in order to protect his thoughts from being intercepted, Magneto wears a helmet made of lead.  Magneto and Professor X are not real, and neither is the ability to read minds, but judging by many of the controls I see in SSAE 16 reports that are supposed to contain only controls that mitigate the risk of material financial misstatement, I would not be surprised to see a control such as "We use lead-lined drywall in our offices to prevent psychics from seeing us enter our passwords."

Recently I have had opportunities to observe several auditors defend why they believe the controls contained in their client's SSAE 16 reports are relevant to internal controls over financial reporting (ICFR).  The auditors argue that the risk events the controls mitigate are "possible."  I have had to explain, to seasoned auditors in some cases, that just because a risk event is possible, does not mean it is reasonable to conclude a control is ICFR relevant.  I mean, sure, some people believe in psychics, and there is probably anecdotal evidence out there that password sniffing via psychic is "possible," but is jumping from there to a control requirement for lead-lined drywall reasonable?  Of course not.  It is equally unreasonable to say that having fire suppression in your data center will prevent you from materially misstating your financials.

Do we really need to explain that physical security, environmental, and operational controls do not belong in SSAE 16 reports, or is there something more sinister going on?  Why haven't auditors required their clients to remove non-ICFR controls from their SSAE 16 reports as the standard requires for the past two years since the launch of SOC reports?  Could it be that the number of controls that require testing in an audit program directly relate to the audit fees that are justified?  

I remember that in years three or four of Sarbanes Oxley compliance my clients would start "control rationalization exercises" where they would evaluate the risk of a control, in order to justify its removal from the external auditor's scope.  It was easy for management to calculate the value of performing this exercise...total audit fees, divided by the number of controls, equals audit fee per control.  It stood to reason that the more controls you could "rationalize", the lower the audit fee should be.

I believe that most auditors know that it is unreasonable to include physical security, environmental, and operational controls in SSAE 16 reports, but they are unwilling to do anything about it until their clients sign up for SOC 2 engagements.  As long as clients do that, audit fees will increase rather than decrease.  How short sighted is that though?  Requiring clients to remove non-ICFR controls would have created an assurance vacuum that SOC 2 was designed to fill.  As it stands now, auditors who issued non-compliant SSAE 16 reports have a credibility problem.

If you are hearing about SOC 2 for the first time, and are looking to engage an auditor, you should ask to see some of their SSAE 16 work before making that decision.  If you are considering a report other than SOC 2 for assurance pertaining to security, availability, and/or confidentiality, please read my posts on why SOC 2 is a superior report to all others below:  

81 comments:

  1. I agree with your point that the auditor may not push the client to remove non ICRF controls from the report in order to preserve fees; however, this is not always the case. In many instances, the client requests the auditor to include non ICRF controls in the report to demonstrate compliance with certain contractual requirements. This is also a way for them to avoid the expense of a separate SOC 2. The auditors, wanting to keep their clients happy, simply look the other way.

    ReplyDelete
    Replies

    1. Reading on the recent ban on dank vapes have made everyon buy weed online and the FDA looks like they are serious this time around.But with weed for sale online, what makes it so certain that we won't see others online without medical marijuana cards buy marijuana or
      mail order cannabis online. This has created a big confusion in the marijuana dispensaries near me regading the issue of
      marijuana for sale online
      Some good articles on buy weed online or marijuana for sale have been published but the reecent ban on Juul pods and juul pods for sale or juul pods online have created dispair on the population. So what is your take on the recent ban on juul? But the weed for sale industry is gradually taking over. Click here to get some insights on medical marijuana for sale and shrooms for sale online .Dank Vapes

      Delete
  2. I concur with your point that the inspector may not push the customer to expel non ICRF controls from the report keeping in mind the end goal to safeguard charges; then again, this is not generally the situation. In numerous cases, the customer demands the evaluator to incorporate non ICRF controls in the report to exhibit consistence with certain contractual necessities. This is additionally a path for them to maintain a strategic distance from the cost of a different SOC 2. The examiners, needing to keep their customers glad, essentially look the other way. Thanks!!!
    helmet sticker


    ReplyDelete
  3. This is very important post about a driver. A driver need to use helmet. not only need must be need to use a helmet.Visit here For information about helmet. Here are a couple tips you can think seriously about when purchasing a head protector.

    ReplyDelete
    Replies

    1. Reading on the recent ban on dank vapes have made everyon buy weed online and the FDA looks like they are serious this time around.But with weed for sale online, what makes it so certain that we won't see others online without medical marijuana cards buy marijuana or
      mail order cannabis online. This has created a big confusion in the marijuana dispensaries near me regading the issue of
      marijuana for sale online
      Some good articles on buy weed online or marijuana for sale have been published but the reecent ban on Juul pods and juul pods for sale or juul pods online have created dispair on the population. So what is your take on the recent ban on juul? But the weed for sale industry is gradually taking over. Click here to get some insights on medical marijuana for sale and shrooms for sale online .Dank Vapes

      Delete
  4. I am curious of possibility to make effective data security audit. How it can be possible for whole if hackers come up with new sophisticated ways to make a breach. I can only say that some systems like virtual data rooms must have more complicated defense on board.

    ReplyDelete
  5. Thanks for sharing the valuable information here. So i think i got some useful information with this content. Thank you and please keep update like this informative details.

    SAS Training

    ReplyDelete
  6. The bike helmet is intended to ensure the leader of a stun and weakened effects to the skull of a cyclist in falls. Regardless of the fact that the helmet is evidently not harmed, it can be delicate and broke in spots that are not unmistakable. Ride with a head protector that has officially gotten a stun can be exceptionally unsafe on the grounds that no more assume a defensive part.

    ReplyDelete
  7. Cruiser devotees have a wide assortment of decision with regards to selecting the privilege Harley head protectors. Maybe the most essential criteria, in any case, while picking the ideal protective cap is to guarantee a legitimate fit.

    ReplyDelete
  8. I was exactly searching for. Thanks for such post and please keep it up. Great work bell rogue motorcycle helmet

    ReplyDelete
  9. Motorcycle enthusiasts have a wide variety of choice when it comes to selecting the right Harley helmets. Perhaps the most important criteria, however, when choosing the perfect helmet is to ensure a proper fit.

    ReplyDelete
  10. If you are an experienced rider or even possibly a new rider, you will need to buy a new helmet at some point in time. Shopping for a new helmet, the selection of helmets for you to choose from can be overwhelming. There are some important details you will want to look for before choosing a helmet.

    ReplyDelete
  11. If you are going for a high quality face shield, you might be surprised at how expensive they can get. However, they will offer several benefits, such as being scratch resistant, and having UV protection. http://www.motorcyclesafer.com/

    ReplyDelete
  12. Taking both into consideration should guide you to the best choice of helmet for your given purpose and needs. Safe and happy riding! Helmet Now

    ReplyDelete
  13. It has been simply incredibly generous with you to provide openly what exactly many individuals would’ve marketed for an eBook to end up making some cash for their end, primarily given that you could have tried it in the event you wanted.
    Java Training in Marathahalli

    ReplyDelete
  14. Expected to form you a next to no word to thank you once more with respect to the decent recommendations you've contributed here.
    hadoop training in chennai

    ReplyDelete
  15. It has been simply incredibly generous with you to provide openly what exactly many individuals would’ve marketed for an eBook to end up making some cash for their end, primarily given that you could have tried it in the event you wanted.

    Data Science Training in Bangalore

    ReplyDelete
  16. Needed to compose you a very little word to thank you yet again regarding the nice suggestions you’ve contributed here.
    AWS Training in Bangalore

    ReplyDelete
  17. spammy blog m8t

    ReplyDelete
  18. It has been just unfathomably liberal with you to give straightforwardly what precisely numerous people would've promoted for an eBook to wind up making some money for their end, basically given that you could have attempted it in the occasion you needed.Nebosh Course in Chennai

    ReplyDelete
  19. I strongly believe that there will be great opportunities for those who looked into this site, thanks much for sharing the useful information keep on sharing...
    Best Online Software Training Institute | Oracle Training

    ReplyDelete
  20. Wow...!! This Post is so intriguing that now i want to know more about this topic. Waiting for your next Post..!! MSR Xpedition LX Helmet

    ReplyDelete
  21. AWS Training in Bangalore - Live Online & Classroom
    myTectra Amazon Web Services (AWS) certification training helps you to gain real time hands on experience on AWS. myTectra offers AWS training in Bangalore using classroom and AWS Online Training globally. AWS Training at myTectra delivered by the experienced professional who has atleast 4 years of relavent AWS experince and overall 8-15 years of IT experience. myTectra Offers AWS Training since 2013 and retained the positions of Top AWS Training Company in Bangalore and India.


    IOT Training in Bangalore - Live Online & Classroom
    IOT Training course observes iot as the platform for networking of different devices on the internet and their inter related communication. Reading data through the sensors and processing it with applications sitting in the cloud and thereafter passing the processed data to generate different kind of output is the motive of the complete curricula. Students are made to understand the type of input devices and communications among the devices in a wireless media.

    ReplyDelete
  22. Very nice post here and thanks for it .I always like and such a super contents of these post.Excellent and very cool idea and great content of different kinds of the valuable information's.
    Good discussion. Thank you.
    Anexas
    Six Sigma Training in Abu Dhabi
    Six Sigma Training in Dammam
    Six Sigma Training in Riyadh

    ReplyDelete
  23. Great site and a great topic as well I really get amazed to read this. It’s really good. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. Click

    ReplyDelete
  24. Expected to form you a next to no word to thank you once more with respect to the decent recommendations you've contributed here.
    industrial safety courses in chennai

    ReplyDelete
  25. Thank you for sharing such a nice and interesting blog with us. i have seen that all will say the same thing repeatedly. But in your blog, I had a chance to get some useful and unique information. I would like to suggest your blog in my dude circle. please keep on updates. hope it might be much useful for us. keep on updating...
    AWS Training in Chennai
    AWS Course in Chennai
    Aws Certification in Chennai
    German Courses in Chennai
    best german classes in chennai
    German language training in chennai

    ReplyDelete
  26. You know what you’re talking about, why waste your intelligence on just posting videos to your blog when you could be giving us something enlightening to read?
    offshore safety course in chennai

    ReplyDelete
  27. I ‘d mention that most of us visitors are endowed to exist in a fabulous place with very many wonderful individuals with very helpful things.
    safety course in chennai
    nebosh course in chennai

    ReplyDelete
  28. Great article, valuable and excellent article, lots of great information, thanks for sharing with peoples.


    ExcelR Data Science Course

    ReplyDelete
  29. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.
    date analytics certification training courses
    data science courses training
    data analytics certification courses in Bangalore
    ExcelR Data science courses in Bangalore

    ReplyDelete
  30. I was surfing net and fortunately came across this site and found very interesting stuff here. Its really fun to read. I enjoyed a lot. Thanks for sharing this wonderful information.
    machine learning course malaysia

    ReplyDelete

  31. It is perfect time to make some plans for the future and it is time to be happy. I’ve read this post and if I could I desire to suggest you few interesting things or tips. Perhaps you could write next articles referring to this article. I want to read more things about it!

    Big Data Course

    ReplyDelete
  32. wow, great, I was wondering how to cure acne naturally. and found your site by google, learned a lot, now i’m a bit clear. I’ve bookmark your site and also add rss. keep us updated.

    Data Science Course Malaysia

    ReplyDelete
  33. This is a wonderful article, Given so much info in it, These type of articles keeps the users interest in the website, and keep on sharing more ... good luck.Data Science Courses

    ReplyDelete
  34. Well, the most on top staying topic is Data Science.Out of all, Data science course in Mumbai is making a huge difference all across the country. Thank you so much for showing your work and thank you so much for this wonderful article.

    ReplyDelete
  35. I was blown out after viewing the article which you have shared over here. So I just wanted to express my opinion on Data Science, as this is best trending medium to promote or to circulate the updates, happenings, knowledge sharing.. Aspirants & professionals are keeping a close eye on Data science course in Mumbai to equip it as their primary skill.

    ReplyDelete
  36. Hi,
    Best article, very useful and well explanation. Your post is extremely incredible.Good job & thank you very much for the new information, i learned something new. Very well written. It was sooo good to read and usefull to improve knowledge. Who want to learn this information most helpful. One who wanted to learn this technology IT employees will always suggest you take Data Scientist Certification In Bangalore.

    ReplyDelete
  37. Attend The Data Analytics Courses From ExcelR. Practical Data Analytics Courses Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Analytics Courses.
    ExcelR Data Analytics Courses

    ReplyDelete
  38. Awesome..I read this post so nice and very imformative information...thanks for sharing
    Click here for data science course

    ReplyDelete
  39. Attend The Data Analytics Courses From ExcelR. Practical Data Analytics Courses Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Analytics Courses.
    ExcelR Data Analytics Courses

    ReplyDelete
  40. Thanks for sharing is so amazing and helpful to us.
    Buy Hydrocodone online

    ReplyDelete
  41. Best Article BUY ADDERALL ONLINE Excellent post. I appreciate this site. Stick with it! Because the admin of this web page is working, no doubt very quickly it will be well-known, due to its quality contents.This website was how do you say it? Relevant!! Finally, I’ve found something that helped me.

    ReplyDelete
  42. Thanks a lot for sharing
    Having good health is what most people out there wants but can not achieve. some people takes buy ibogaine online AND buy weed online to get it.

    ReplyDelete
  43. Thanks for Valuable Information man, IT was Really Fantastic.,

    Also, Please reach me for all types of loans - Personal loan at low interest rate in Bangalore

    Trust me Its Really Worth trying for Certified Oneplus service center in Marathahalli

    ReplyDelete

  44. Best Article buy Pain Pills online Excellent post. I appreciate this site. Stick with it! Because the admin of this web page is working, no doubt very quickly it will be well-known, due to its quality contents.This website was how do you say it? Relevant!! Finally, I’ve found something that helped me.
    Best Article buy Roxicodone online Excellent post
    buy Xanax online
    buy Oxycodone online

    Best Article buy Pain Medications online Excellent post. I appreciate this site. Stick with it! Because the admin of this web page is working, no doubt very quickly it will be well-known, due to its quality contents.This website was how do you say it? Relevant!! Finally, I’ve found something that helped me.

    buy Research Chemicals online

    buy Roxicodone online

    buy Cbd Isolate online

    ReplyDelete
  45. Best content.Thank you so much for sharing,i have learnt something new.I hope you will share more information like this,keep updating.
    Best Data Science Certification Course in Bangalore

    ReplyDelete

  46. Welcome to Scottish Fold Cattery and thanks for your interest click here to Adopt A Scottish Fold Kitten online to our scottish cats and kittens For sale! My name is VERA S. Matt. Me and my husband Owns the small scottish fold farm with the best Scottish fold kitten prices and share my biggest hobby/ Scottish Fold Kittens For Sale cat breeding hence scottish fold Breeders. We breed breeds Scottish Folds. All our Scottish Fold cats have very special Grand Champion blood lines from Europe . We love our cats, they live in the Cattery with us.Scottish Folds are known to be very good natured, affectionate cats who are very human-orientated and become extremely attached to their owners.here Scottish Fold Cats They are easy going and will appreciate the company and cubby holes of any type. They enjoy attention and are not usually shy with strangers. Affectionate without being “pushy”,they make ideal pets and companions.scottish cats and kittens For saleBrowse through our available scottish fold cats and see the Munchkin Scottish folds,Grey Scottish fold kittens,Black scottish fold kittens Since we offer shipping worldwide.Scottish Fold kittens breederKittens For Sale at the catter.Scottish fold kitten prices We also offer Scottish fold kittens near me,Scottish Fold Breeders,Scottish fold Price.
    Buy passport online We are a group of unique experts who manufacture real and fake passports, IDs, buy driver’s licenses and other documents proving your identity or qualification. We have many years of experience in this field that’s why you can be absolutely sure that no matter what you order from us, you will always receive a high-quality document that meets the necessary…buy IELTS certificate online
    Buy passport online
    buy registered documents online

    ReplyDelete
  47. dank vapes are the best brand of vape cartridges in the market. These dank vapes cartridges have however suffered a backlash in the recent weeks with multiple reports on how these dank vapes carts cause cancer and other related lung disease.
    dank vapes cart however remain one of the best cartridges. dank vapes are sold in multiple states over the USA. dank vapes cart compost one of the black markets finest vape products. But this backlash has caused a fall in the consumption of the vape by adults.The 710 Kingpen brand is also on the rise in market demands as well as skywalker OG products.
    Recently juul pods also faced a similar backlash. juul starter kits have also fallen in market demand. mango juul pods are refillable juul pods and can be gotten as juul pods bulk. juul skins and juul accessories all come with the juul kits.
    buy juul online at cheap prices buy cocaine online

    ReplyDelete
  48. Welcome to Scottish Fold Cattery and thanks for your interest click here to Adopt A Scottish Fold Kitten online to our scottish cats and kittens For sale! My name is VERA S. Matt. Me and my husband Owns the small scottish fold farm with the best Scottish fold kitten prices and share my biggest hobby/ Scottish Fold Kittens For Sale cat breeding hence scottish fold Breeders. We breed breeds Scottish Folds. All our Scottish Fold cats have very special Grand Champion blood lines from Europe . We love our cats, they live in the Cattery with us.Scottish Folds are known to be very good natured, affectionate cats who are very human-orientated and become extremely attached to their owners.here Scottish Fold Cats They are easy going and will appreciate the company and cubby holes of any type. They enjoy attention and are not usually shy with strangers. Affectionate without being “pushy”,they make ideal pets and companions.scottish cats and kittens For saleBrowse through our available scottish fold cats and see the Munchkin Scottish folds,Grey Scottish fold kittens,Black scottish fold kittens Since we offer shipping worldwide.Scottish Fold kittens breederKittens For Sale at the catter.Scottish fold kitten prices We also offer Scottish fold kittens near me,Scottish Fold Breeders,Scottish fold Price.
    Buy passport online We are a group of unique experts who manufacture real and fake passports, IDs, buy driver’s licenses and other documents proving your identity or qualification. We have many years of experience in this field that’s why you can be absolutely sure that no matter what you order from us, you will always receive a high-quality document that meets the necessary…buy IELTS certificate online
    Buy passport online
    buy registered documents online

    WELCOME TO pug puppies BREEDERS HOME BUY A PUG ONLINE|PUG PUPPIES FOR SALE|ADOPT A PUG ONLINE|PUG|BLACK PUG PUPPIES FOR SALE
    We are so glad you stopped by to check out our amazing TEACUP Pug puppies. All of our animals come fully up to date on vaccinations, heart-worm tested negative, and de-wormed, as well as neutered, and treated for any ailments found upon veterinary examination Adopt a teacup Pug puppy
    Ownership of a Pug includes a commitment that is wider in scope than providing doggy necessities and allowing this jovial little pet to occupy a portion of your home. Pug ownership is a give-and-take relationship that will continue throughout the little dog’s life. That enjoyable companionship thrives when each member of the pair respects the other and camaraderie rules the union. Your Pug will entertain you, love you, and be obedient and faithful to you if you spend time with your doggy friend.
    Adopt a pug puppies online puppy onlie or pug puppies for sale online does not all depends on the money involve. You have to love
    Black pug puppies for sale at heart before you go in search of pug puppies for sale or adopt a pug puppy.This means that you have to keep the pug puppy price or cost of a pug puppy or a teacup puppy in mind before you harnest the interest of buying a pug online.

    ReplyDelete
  49. Welcome to Ragdoll Kittens Cattery click here to adopt a ragdoll

    kitten online
    We are a small and loving cattery . We are pleased that you have chosen to visit our Ragdoll

    cats/Ragdoll kittens cattery, and hope you will notice right away from our website how beautiful and loved our

    Ragdoll cats and kittens are. These beauties are easily integrated into our loving family home, first as

    mothers carrying the litters, and then from the time the ragdoll kittens are born until they are adopted so we

    always have Ragdoll kittens for sale|Ragdoll kittens for adoption|Ragdoll kitten price|Ragdolls|Cost of Ragdoll

    kittens|. Our adult cats have tested negative for HCM and PKD1 through University of California Davis. Upon

    request, we have five generations of pedigree documentation on our adults available to anyone who is

    interested. Ragdoll kittens are registered with The International Cat Association (RAGDOLL KITTENS FOR SALE),and are never caged. The cats that are

    in our reputable breeding program can produce mink, sepia and traditional Ragdoll kittens. Ragdolls have a

    laid-back personality and enjoy being physically handled making them one of the best lap cats! We are all

    family here at Ragdoll kittens cattery since we are ragdoll kitten breeders and all the love we bestow by

    holding each cat and kitten daily further Teacup RAGDOLL Kittens

    for sale|Hypoallergenic kittens for sale
    nurtures their loving personalities and temperaments,TICA/CFA REGISTERED RAGDOLL KITTENS FOR SALE thanks for adopting a

    ragdoll ketten from us

    Welcome to our farm where we breed Registered pomeranian puppies

    for sale
    .As a registered pomeranian puppies breeder, we have made it possible for pomeranian puppy lovers

    to
    buy pomeranian puppies online,buy zwergpitz pomeranian from our family run farm. Pomeranian

    dogs are small dogs with a weight of 1.36 to 3.17 kg and a withers height of 15 to 18 cm. They are compact but

    robust dogs with a lush, textured coat and a tall and flat tail. The top coat forms a fur ruff on the neck, for

    which poms are known, and on the hindquarters they have a margin of feathered hair.You can click HERE to view our available pomeranian puppies

    ReplyDelete
  50. I was taking a gander at some of your posts on this site and I consider this site is truly informational! Keep setting up..
    360DigiTMG data science course
    360DigiTMG big data analytics course malaysia
    360DigiTMG data analytics courses
    360DigiTMG

    ReplyDelete
  51. dank vapes are the best brand of vape cartridges in the market. These dank vapes cartridges have however suffered a backlash in the recent weeks with multiple reports on how these dank vapes carts cause cancer and other related lung disease.
    dank vapes cart however remain one of the best cartridges. dank vapes are sold in multiple states over the USA. dank vapes cart compost one of the black markets finest vape products. But this backlash has caused a fall in the consumption of the vape by adults.The 710 Kingpen brand is also on the rise in market demands as well as skywalker OG products.
    Recently juul pods also faced a similar backlash. juul starter kits have also fallen in market demand. mango juul pods are refillable juul pods and can be gotten as juul pods bulk. juul skins and juul accessories all come with the juul kits.
    buy juul online at cheap prices buy cocaine online
    buy Keytruda online and other cancer medications such as buy avastin online , buy Herceptin online
    jungle boys , buy weed online

    ReplyDelete
  52. Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work!
    360digitmg business analytics courses
    data science course
    data analytics course

    ReplyDelete