Today, it is common for entities to outsource to a service organization certain tasks or functions related to their business, even those that are core to their operations.  By engaging an independent CPA to examine and report on a service organization’s controls, service organizations can respond to meet the needs of their user entities and obtain an objective evaluation of the effectiveness of controls that address operations and compliance, as well as financial reporting.  To provide the framework for CPAs to examine controls and to help management understand the related risks, the AICPA established three Service Organization Control (SOC) reporting options.