A SOC 1 report contains five components: (Grant Thorton, 2012).
1. The external auditor’s report: The section would define the scope of the audit that specifies what the audit area is and the audit period at Apple. It also expresses the external auditor’s opinions on the test conclusions. This section may not cover the services that are outsourced by the service organization (Grant Thorton, 2012). Since Amazon is certified in SOC compliance standards, this report may skip the audit report for Amazon.
2. Management assertion: The section would include a fair presentation of the description about the company (Grant Thorton, 2012), including the working of iCloud and the outsourcing of some components to Amazon Web Services. It would also state the controls that are included in the description are suitably designed and they are …show more content…
System description of the service organization: The section would include the services provided by iCloud. It consists of a description of the IT environment and the systems in use, the related IT general computer controls, and risk assessment in certain aspects such as physical and logical access to the system (Grant Thorton, 2012).
4. Control objectives and control activities: The section would list all the control objectives at Apple, along with all the control activities being done to meet the control objectives. The external service auditor would test all the control activities included for a control objective and specify the test results. The results of these tests are presented, mostly in a tabular form, that contains the control activities tested, the tests that were performed, and the results of these tests (Corporate One, 2015).
5. Supplementary information: The final section may embrace information that would not be subjected to audit, but is willing to be shared by Apple, including strategic plans and disaster recovery under certain circumstance such as hack attacks in iCloud (Corporate One,