AT-C 320 is the rulebook a CPA firm follows when it writes a SOC 1.

The AICPA groups its attestation rules into numbered sections. AT-C 320 is the one written for a single job: examining a service provider whose work feeds its clients' financial statements. When a CPA firm issues a SOC 1 report, this is the section it follows.

Spelled out: AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting.

The section decides what kind of report you get. Because AT-C 320 is about financial reporting, the report is built on control objectives that management writes, and its intended readers are your clients and their financial auditors. A SOC 2 runs under a different route, the general examination section AT-C 205 with the Trust Services Criteria, and serves a wider readership interested in security. Picking the wrong one is an expensive mistake: a payroll bureau with a SOC 2 may still be asked for a SOC 1 by a client's auditor, because only the AT-C 320 report addresses what that auditor needs to rely on.

The opinion paragraph of a SOC 1

The service auditor states the examination was conducted under the attestation standards established by the AICPA; the engagement letter names AT-C 320 directly.

A client's audit planning memo

The user auditor records whether a SOC 1 is available and which period it covers.

Scoping workshops

Where you decide which processes touch client ledgers and so belong in an AT-C 320 examination.

Requests for proposal

Finance-heavy buyers sometimes name the standard rather than the report.

AT-C 205

The general section for examination engagements. SOC 2 work runs under it, with the Trust Services Criteria. AT-C 320 is the specialised section for controls relevant to clients' financial reporting.

SSAE 18

The statement that codified the attestation standards, including AT-C 320. SSAE 18 is the book; AT-C 320 is one chapter in it.

• List which of your services change a number in a client's books; those are the candidates for an AT-C 320 scope.
• Ask a client's finance team whether their auditor needs a SOC 1 before you commit to a SOC 2.
• Draft control objectives early, since AT-C 320 expects management to define them.

• GuideAT-C 320: the SOC 1 standardControls at a service organization that touch financial reporting.
• GuideSOC 1, explainedWhat a SOC 1 covers, AT-C 320, and bridge letters.
• GuideSOC 1 or SOC 2: which do you need?A decision path for service providers asked for either.

Sources: AICPA SSAE 18; AT-C section 320; AT-C section 205; AICPA guide on SOC 1 reporting; AICPA SOC suite descriptions.