Critical digital services from third party providers increase firms’ operational, security, and financial risks. The System and Organization Controls (SOC) framework is a standardized assurance approach intended to reduce information asymmetry between service providers and stakeholders. This paper brings together archival and experimental research on SOC and connects those findings to broader ideas in monitoring and governance. The goal is to show how SOC practices fit into firms’ efforts to build operational resilience and stakeholder assurance. It also outlines several research designs, including event？studies, regulatory shock settings, and matched difference-in-differences approaches that future work could use to study the causal effects of SOC adoption. These contributions position the paper as a conceptual and practical roadmap for guiding subsequent research and applied investigations.
References
[1]
AICPA (n.d.). SOC for Service Organizations: Overview and Guidance. American Institute of Certified Public Accountants.
[2]
Daft, R. L., & Lengel, R. H. (1986). Organizational Information Requirements, Media Richness and Structural Design. Management Science, 32, 554-571. https://doi.org/10.1287/mnsc.32.5.554
[3]
Perols, J. L. (2025). How Do Investors Perceive System and Organization Controls (SOC) for Cybersecurity? Current Issues in Auditing, 19, P60-P66.
[4]
Powell, J. H. (2021). Press Conference Following the Federal Open Market Committee Meeting. Board of Governors of the Federal Reserve System. https://www.federalreserve.gov/mediacenter/files/FOMCpresconf20210428.pdf
[5]
Schoenfeld, J. (2024). Cyber Risk and Voluntary Service Organization Control (SOC) Audits. Review of Accounting Studies, 29, 580-620. https://doi.org/10.1007/s11142-022-09713-0
[6]
Spence, M. (1973). Job Market Signaling. The Quarterly Journal of Economics, 87, 355-374. https://doi.org/10.2307/1882010
[7]
Williamson, O. E. (1985). The Economic Institutions of Capitalism: Firms, Markets, Relational Contracting. Free Press.
