SOC-1 report for subservice organization AWS

[tschr1]

In their SOC-1 report SAP Concur make reference to AWS (Amazon Web Services) as subservice organization. SAP Concur, in their SOC-1 report and the auditors in their audit opinion explicitly disclaim any responsibility for the subservice organization's (AWS) controls - which is of course general practice. But this forces the Concur clients to assess the AWS subservice org SOC-1 report themselves. Concur, however, refuses to provide the AWS SOC-1 report (and bridge letter).

How are users dealing with this issue in light of their own financial statement audits? Where else have you obtained the AWS SOC-1 report form, if you are not a direct AWS customer already?

[KevinD · Accepted solution]

@tschr1 Hello there. This question would be better asked in the Admin Group. You can request to join that group here on the Community. 

You do need to have some admin permissions in the SAP Concur system to be eligible for admittance to the group. This forum is mostly trafficked by end users and not those who would work with SOC-1 reports.

[tschr1]

Thank you, Kevin. I will do as you suggested.