Glossary · SOC and attestation
Every SOC 1 control has to earn its place under a control objective.
A statement of the result a set of controls must achieve, written by service organization management and used as the yardstick in a SOC 1 examination.
Back to the glossary01 · In plain words
In plain words
A statement of the result a set of controls must achieve, written by service organization management and used as the yardstick in a SOC 1 examination.
A control objective says what must go right, such as payments being recorded completely and accurately. The controls are the steps that make it happen. In a SOC 1, management writes the objectives, and the CPA firm tests whether the controls achieve them.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Objectives decide the shape of a SOC 1. Too broad, and the report says little a client's auditor can use. Too narrow, and it misses risks the auditor cares about, which leaves gaps they must test themselves. Because management writes them, objectives are a choice, and a reader judges the report partly by whether they cover the transactions that reach the reader's books. A SOC 2 works differently: the AICPA's Trust Services Criteria fix the goals, so there is nothing for management to write.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Section 4 of a SOC 1
- Each objective heads a table of controls, the auditor's tests and the results.
- Management's assertion
- Management states the controls were suitably designed to achieve the stated objectives.
- Scoping sessions with the CPA firm
- Where draft objectives are tested against what clients' auditors will need.
- A user auditor's mapping
- The client's auditor maps each objective to the risks in their own audit.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a treasury reconciliation service for mid-size lenders
A firm reconciles bank statements against loan ledgers for several lenders. Its first draft has one objective: reconciliations are performed. A client's auditor points out that this says nothing about accuracy or timing. The firm rewrites it: controls provide reasonable assurance that bank and ledger balances are reconciled completely, accurately and within the agreed cut-off, and that differences are investigated. Under it sit four controls, from automated matching to supervisor review of unmatched items.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Control
- A control is the action or mechanism, such as a supervisor's sign-off. The objective is the outcome that action supports.
- Trust Services Criteria
- The fixed criteria a SOC 2 is measured against, set by the AICPA. SOC 1 objectives are written by management for its own service.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Start from the transactions you process for clients and the financial statement assertions they affect.
- Write each objective as a result, not an activity, and keep it testable over a period.
- Ask two or three clients' finance teams whether the objectives cover what their auditors test.
- GuideControl objectives in a SOC 1How to write them, and why they come before the controls.
- GuideThe SOC 1 system descriptionWhat the description must say, and how it is tested.
- GuideHow to read a SOC 1 reportThe sections, the opinion, and the exceptions that matter.
Sources: AT-C section 320; AICPA guide on SOC 1 reporting; AICPA Trust Services Criteria (TSP section 100).
Questions about Control objective
Does a SOC 2 have control objectives?
Not in the SOC 1 sense.
A SOC 2 measures controls against the Trust Services Criteria, which the AICPA publishes. Management does not write the goals. Some reports group controls under headings that look like objectives, but the criteria are what the opinion refers to.
Can control objectives change between reports?
Yes, with care.
Objectives can be added or reworded when the service changes. A reader comparing years will notice, so it helps to explain the change in the system description rather than let it pass silently.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.