Quality at SAP

SOC 1: Provides the auditor of a user entity’s financial statements information about controls at a service organization that may be relevant to a user entity’s internal control over financial reporting. A Type 2 SOC 1 report includes a detailed description of tests of controls performed by the CPA and results of the tests.

Note: SOC 1 (ISAE3402 / SSAE16) reports are only available for customers who had live, financially-relevant systems during the last audit period. Please contact your SAP sales representative to attain this report.

SOC 2: Provides management of a service organization, user entities, and others a report about controls at a service organization relevant to the security, availability, or processing integrity of the service organization’s system, or the confidentiality and privacy of the data processed by that system. A Type 2 SOC 2 report includes a detailed description of tests of controls performed by the CPA and results of the tests.

SOC 3: Provides users and interested parties a report about controls at the service organization related to security, availability, processing integrity, confidentiality or privacy. SOC 3 reports are a short-form report (i.e., no description of tests of controls and results) and may be used in a service organization’s marketing efforts.