SOC 1 (System and Organization Controls 1, SSAE 18)
SOC 1 is an audit report that evaluates the controls at a service organization relevant to its clients' internal control over financial reporting (ICFR). It exists so that clients can rely on these audited controls rather than performing their own manual audits of the service provider.
Who it applies to
- Payroll and human resources outsourcing providers.
- Cloud service providers hosting financial applications or sensitive accounting data.
- Payment processing and transaction gateways.
- Loan servicing, trust administration, or escrow companies.
How it works
SOC 1 is based on the SSAE 18 standard issued by the AICPA. It focuses exclusively on controls that impact a client's balance sheet or income statement. The process involves an independent CPA firm evaluating whether the service organization's described controls are designed and operating effectively to prevent or detect financial misstatements.
There are two types of reports: Type I and Type II. A Type I report evaluates the design of controls at a specific point in time, confirming that they exist as described. A Type II report is more rigorous; it evaluates both the design and the operational effectiveness of those controls over a period, typically six to twelve months.
The final output is an attestation report. This document includes a description of the system, management's assertion that the controls are effective, and the auditor's opinion based on their testing results. Clients then provide this report to their own auditors as evidence of third-party control compliance.
Getting started
- Identify which internal controls directly impact your customers' financial reporting processes.
- Document these control activities in written policies and standard operating procedures.
- Conduct a gap analysis to identify where current practices deviate from the required controls.
- Remediate identified gaps by implementing new controls or updating existing ones.
- Select an independent CPA firm licensed to perform SSAE 18 audits.
- Define the "review period" for your Type II audit and begin collecting evidence of control execution.
Controls & requirements
- What a SOC 1 report is
- Control objectives
- SOC 1 Type I vs Type II
- SSAE 18 SSAE 18: the standard behind SOC 1
- Complementary user entity controls (CUECs)
- Why customers ask for it: ICFR
- Scoping a SOC 1 engagement
- Management's description of the system
- Auditor testing and the opinion
- Bridge (gap) letters
- SOC 1 vs SOC 2: which do you need
Common misconceptions
- Confusing SOC 1 with SOC 2; while SOC 2 focuses on security, availability, and privacy (the Trust Services Criteria), SOC 1 is strictly concerned with financial reporting controls.
- Viewing it as a "certification"; unlike ISO standards, SOC 1 results in an attestation report rather than a certificate of compliance.