Compliance / SOC 1
SOC 1 readiness for services that touch your customers' books.
A SOC 1 report covers controls at a service organization that are relevant to its customers' internal control over financial reporting. Payroll processors, claims administrators, loan servicers, data centers and financial software providers are typical examples.
Customers and their auditors rely on SOC 1 reports during financial statement audits. We help you define control objectives, close gaps and prepare for the CPA firm's examination.
At a glance
- Issued by
- A licensed CPA firm
- Standard
- AICPA SSAE 18 (AT-C 320)
- Focus
- Controls relevant to customers' internal control over financial reporting
- Report types
- Type 1 covers design on one date. Type 2 covers operation over a period.
- Audience
- Customers and their financial statement auditors
SOC 1
SOC 1 or SOC 2?
SOC 1 is about financial reporting. SOC 2 is about security, availability, processing integrity, confidentiality and privacy. If your customers' auditors ask for your report during their financial audit, you likely need SOC 1. If your customers' security teams ask during vendor reviews, you likely need SOC 2.
Many service organizations need both. Controls such as access management and change management appear in each, so one program can support both reports.
How we help
Readiness assessment
Define what the report will cover.
- Control objective definition
- Process walkthroughs and control identification
- Gap assessment
- Complementary user entity controls
IT general controls
The technical controls behind reliable processing.
- User access provisioning and reviews
- Change management
- Job scheduling and processing monitoring
- Backup and recovery
Audit support
A smoother examination.
- Evidence preparation
- Help choosing a CPA firm
- Support during fieldwork
- Remediation of exceptions
Who issues the report
Only licensed CPA firms can issue a SOC 1 report. We prepare you for the examination and work alongside the firm you choose.
FAQ
Frequently asked questions
Who defines the control objectives in a SOC 1?
Management does, based on the services provided and what matters to customers' financial reporting. The CPA firm then tests whether the supporting controls are designed and, for Type 2, operating effectively.
Do IT controls belong in a SOC 1?
Usually. IT general controls such as user access, change management and backup support the processing customers rely on, so they almost always appear in scope.
Find out where you stand on SOC 1.
A readiness review shows what an assessor would find today and what it will take to close the gaps.