Client Snapshot
A US-based auditing firm engaged Pierag to support SOC 1 Type 2 and SOC 2 Type 2 engagements for a client operating in the agricultural finance and secondary loan market. The engagement covered controls across loan processing, interest rate locking and loan purchase activities, alongside relevant technology and IT general controls.
The assessment was conducted in accordance with applicable SSAE 18 attestation requirements during the auditing firm’s peak audit period, requiring structured testing and coordinated evidence collection across financial workflows and supporting IT controls.
The Challenge
- Distinct assurance requirements: Addressing SOC 1 control objectives alongside SOC 2 Trust Services Criteria for Security and Availability.
- Financial process complexity: Assessing controls across loan processing, interest rate locking and loan purchase activities, where reliable execution and supporting evidence were essential.
- Reliable testing populations: Establishing the completeness and accuracy of control populations, configuration details and supporting evidence before sample testing.
- Consistent audit documentation: Maintaining traceable testing records across financial process controls, entity-level controls and ITGCs.
- Coordinated issue resolution: Coordinating with control owners and client management to resolve evidence queries, finalize audit observations, and review formal management responses within engagement timelines.
Our Approach
- Executed dual-scope controls testing: Performed design and operating effectiveness testing of controls aligned with SOC 1 control objectives and the SOC 2 Trust Services Criteria for Security and Availability.
- Assessed critical financial workflows: Conducted walkthroughs with control owners across loan processing, interest rate locking, loan purchase activities, entity-level controls, and IT general controls covering access, change, risk, and vendor management.
- Validated populations and evidence: Prepared evidence request lists outlining population and configuration requirements, reviewed submissions for completeness, validated population accuracy, and communicated follow-up queries and sample selection details.
- Maintained review-ready documentation: Prepared detailed testing workpapers, sample test sheets and observation logs, updating engagement files using the auditing firm’s documentation tools.
- Supported findings and management responses: Maintained stakeholder communication throughout the engagement, finalized audit observations with client management, and reviewed formal management responses to identified deficiencies.
Results Delivered
- Supported integrated SOC testing: Helped execute testing across financial process controls and relevant IT controls within the two SOC engagement scopes.
- Strengthened Evidence-Based Assessment: Validated control populations and reviewed supporting evidence to substantiate testing procedures and outcomes.
- Improved audit traceability: Maintained structured workpapers and testing records to support review of control procedures, observations and conclusions.
- Supported findings resolution: Facilitated the finalization of audit observations and review of management responses, providing a documented basis for follow-up.
- Augmented peak-period delivery capacity: Provided additional execution support to help the auditing firm manage concurrent reporting requirements within its established engagement framework.
Impact
Pierag provided the auditing firm with additional capacity and structured execution support across two SOC engagements involving financial process controls and supporting technology controls. By combining walkthroughs, population validation, evidence-based testing and organized documentation, the team helped the firm manage the engagement workload while maintaining alignment with its established audit methodology.
The engagement strengthened testing discipline, evidence traceability and coordination of control observations, supporting the auditing firm’s delivery of SOC reporting commitments during a demanding audit period.
