SOC 1 answers a question asked by your client's financial auditor.

If your service changes numbers that end up in a customer's accounts, their auditor needs to trust your controls. A SOC 1 report gives that auditor the evidence. Its audience is accountants, not security teams.

Spelled out: System and Organization Controls 1, a report on controls relevant to user entities' internal control over financial reporting.

A SOC 1 exists because of financial statement audits. When a company outsources payroll, billing or transaction processing, its external auditor cannot ignore what happens outside its walls. The SOC 1 lets that auditor rely on the provider's controls instead of testing them directly. The control objectives are set by the service organization, so the report fits the service rather than a fixed list. It is restricted in use: meant for the service organization, its customers and their auditors. For a provider whose clients are listed companies, a SOC 1 often supports their Sarbanes-Oxley (SOX) work.

A client's year-end audit

The client's financial auditor asks for the SOC 1 to plan reliance on the provider's controls.

Section 3, control objectives

Objectives such as payroll calculated accurately or payments posted completely, each with the controls that achieve it.

SOX 404 testing at a listed client

The client's management uses the report when assessing its own internal control.

Outsourcing contracts

Finance-related service agreements often require an annual SOC 1, sometimes with a bridge letter.

SOC 2

SOC 2 covers security and related categories against the Trust Services Criteria for a broader audience. SOC 1 is about financial reporting only.

SOX compliance

SOX is a US law for listed companies. A SOC 1 is evidence a provider gives its clients to help with their SOX work.

• Ask whether your service touches figures in clients' financial statements.
• Draft control objectives with the client's auditor's likely questions in mind.
• List the controls your clients must run themselves, the complementary user entity controls.
• Decide on Type 1 or Type 2 based on what client auditors expect.

• GuideSOC 1, explainedWhat a SOC 1 covers, AT-C 320, and bridge letters.
• GuideWho needs a SOC 1 report?A test for service providers whose work touches clients' financial statements.
• GuideSOC 1 and Sarbanes-OxleyHow a service provider's report feeds a client's SOX work.

Sources: AICPA SSAE 18, AT-C section 320; AICPA guide, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1); AU-C section 402; Sarbanes-Oxley Act of 2002, section 404.