AT-C section 320
AT-C 320: reading the standard a SOC 1 is built on.
AT-C section 320 governs reporting on an examination of controls at a service organization relevant to user entities' internal control over financial reporting. It is the only AT-C section written for one kind of SOC report. This page reads the standard itself; the basics of a SOC 1 are on a separate guide.
Back to SOC 2 services01 · Scope
The scope test: does it touch a customer's financial statements?
AT-C 320 applies only where your service is relevant to customers' ICFR.
ICFR, short for internal control over financial reporting, is the set of controls that make an entity's financial statements reliable. AT-C 320 is for a service organization whose processing, records or controls could affect those statements at its customers, which the standard calls user entities.
| Illustrative service | Likely in AT-C 320 scope? | Why |
|---|---|---|
| Payroll processing | Yes | Payroll expense and liabilities flow into customers' books |
| Loan servicing for lenders | Yes | Balances and interest feed customers' financial statements |
| Cloud hosting of a billing platform | Possibly | Depends on whether hosting controls bear on billing data integrity |
| A team chat tool | Unlikely | Little or no bearing on customers' financial reporting |
02 · Control objectives
Control objectives written by management
The biggest difference from SOC 2: management writes the yardstick.
AT-C 320 (SOC 1)
Management-defined
- Management sets control objectives for the system
- The CPA first judges whether they are suitable: reasonable, complete and relevant to user entities' ICFR
- The description requirements sit inside the standard
AT-C 205 with TSP 100 (SOC 2)
AICPA-defined
- The trust services criteria are fixed by the AICPA
- Management writes controls, not the criteria
- The description is measured against DC 200
An illustrative objective
“Controls give reasonable assurance that each payroll change is authorized, captured in full and without error, and applied to the correct pay period.” Each objective then lists the controls that achieve it, and a Type 2 tests those controls.
03 · Type 1 and Type 2
What each type reports on under AT-C 320
Both cover the description and design; only Type 2 covers operation over a period.
| Type 1 | Type 2 | |
|---|---|---|
| Date | As of a specified date | Throughout a specified period |
| Description | Fairly presented | Fairly presented |
| Design of controls | Suitably designed to achieve the objectives | Suitably designed to achieve the objectives |
| Operation of controls | Not covered | Operated effectively |
| Tests and results | Not included | Described in the report |
04 · Readers
Who reads it: user entities and their auditors
A SOC 1 is written for auditors of your customers, not for security reviewers.
- User entity
- A customer that uses the service organization's system.
- User auditor
- The customer's financial statement auditor, who uses the SOC 1 as audit evidence about controls outside the customer's walls.
- Service auditor
- The CPA firm examining the service organization under AT-C 320.
- Restricted use
- The report is intended for the service organization's management, user entities and their auditors.
The user auditor applies its own auditing standard on service organizations (for example AU-C 402 or, for public company audits, the PCAOB's AS 2601). AT-C 320 is written so its report fits into that work.
05 · Subservice and CUECs
Subservice organizations and complementary controls
AT-C 320 recognizes two ways to present a vendor, and controls the design assumes others perform.
| Topic | Carve-out method | Inclusive method |
|---|---|---|
| Subservice controls in the description | Excluded; the description names the vendor and its services | Included and described |
| Subservice controls in the examination | Not tested | Tested along with the service organization's controls |
| Assertions | Service organization only | The subservice organization also provides a written assertion |
| What the description must add | Complementary subservice organization controls (CSOCs) assumed of the vendor | Which controls belong to which organization |
Complementary user entity controls (CUECs) name the actions the service organization's design expects its customers to carry out, such as reviewing payroll reports before approval. AT-C 320 expects them to be identified in the description, and the user auditor tests them at the customer.
06 · Against SOC 2
How AT-C 320 differs from the SOC 2 route
Same examination engine; different subject, criteria and reader.
| AT-C 320 (SOC 1) | SOC 2 | |
|---|---|---|
| Subject-matter section | AT-C 320 | None; AT-C 105 and 205 with the SOC 2 guide |
| Criteria for controls | Management's control objectives | Trust services criteria (TSP 100) |
| Criteria for the description | Requirements in AT-C 320 | Description criteria (DC 200) |
| Focus | Financial reporting | Security, availability, processing integrity, confidentiality, privacy |
| Typical reader | User auditors | Customers' security and risk teams |
Sources: AICPA SSAE No. 18, AT-C section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting, as amended; AICPA SOC 1 guide (2025 edition); PCAOB AI 18 on AS 2601 for the carve-out and inclusive definitions. Services in tables are illustrative.
Questions about AT-C 320
Can one examination produce both a SOC 1 and a SOC 2?
Two reports, often planned together.
They use different criteria and reach different readers, so they are separate reports. Firms frequently share walkthroughs and evidence where the controls overlap.
Who decides whether our control objectives are good enough?
Management writes them; the CPA judges suitability.
Under AT-C 320 the service auditor evaluates whether management's objectives are reasonable and relevant to user entities' financial reporting before testing anything against them.
Our customer's auditor asked for a SOC 1, but we have a SOC 2. Is that enough?
Usually not on its own.
A user auditor needs evidence about controls relevant to financial reporting. A SOC 2 may help, but it was not built for that purpose; ask what the auditor actually needs.
Does AT-C 320 require us to monitor our vendors?
The description must explain how vendors are presented and monitored.
Where a carve-out is used, the description identifies the vendor and the controls assumed of it. How management monitors that vendor is a common area of inquiry.
Find out whether you need AT-C 320 at all.
We help you test whether your service is relevant to customers' financial reporting before you commit to a SOC 1.