SOC 1

What is SOC 1?

A SOC 1 report is an independent auditor’s examination of the controls at a service organisation that could affect its customers’ internal control over financial reporting. If a company outsources payroll, claims processing, transaction processing or fund administration, the provider’s controls become part of how that company produces its accounts. A SOC 1 report lets the company, and the auditor who audits its financial statements, rely on those controls without visiting the provider.

It is one of the AICPA’s System and Organization Controls (SOC) reports. Independent CPA firms carry out the examination under the AICPA’s attestation standards.

Who is it for?

The report is meant for the provider’s customers, which the standards call user entities, and for their auditors, the user auditors. Because it is written for that audience, its distribution is restricted: it isn’t a marketing document to publish on a website.

Type 1 and Type 2

• A Type 1 report covers the description of the provider’s system and whether its controls are suitably designed, at a point in time.
• A Type 2 report also tests whether the controls operated effectively over a period, often six to twelve months, and reports any exceptions found.

Customers’ auditors usually need a Type 2, because they want evidence that controls worked throughout the year they are auditing.

What else should customers check?

A SOC 1 report often lists complementary user entity controls: things the customer must do for the provider’s controls to work, such as reviewing the reports it receives. It may also carve out subservice organisations, such as the data centre the provider uses. Read both sections, because the report’s assurance depends on them.

How does it relate to other frameworks?

SOC 2 covers security, availability, processing integrity, confidentiality and privacy rather than financial reporting, and is the report most technology customers ask for. SOC 3 is a short, general-use version of a SOC 2. Some providers produce both a SOC 1 and a SOC 2 from one programme of controls.