SOC 1
You have received a SOC 1. Here is what to do with it.
A provider has sent you its SOC 1 report, perhaps because your auditor asked. It may run to a hundred pages. Your job is narrower than reading all of it: decide whether it covers the processes, period and controls your financial statements rely on, and what you still have to do yourself.
Back to SOC 2 services01 · Three first checks
Three checks before anything else
If any of these fails, the rest of the report matters less.
- The opinion. Is it unmodified? If it is qualified, which control objectives does the qualification touch? Read the paragraph that explains it.
- The period. Is it a Type 2 covering a period? How much of your fiscal year does it overlap? A Type 1 speaks to design at one date only.
- The control objectives. Do they cover the processes you outsource? A report on payroll calculation is of little help if your concern is year-end tax filing.
02 · Reading order
A reading order for finance teams
Follow the questions, not the page numbers.
- Service auditor's report. The opinion, the period, the method used for subservice organizations and any modifications.
- Management's assertion. What the provider is claiming, and for which system.
- Scope of the description. Which services, locations and applications are covered. Confirm yours is among them.
- Control objectives. Map each one to an account or process in your books that it protects.
- Tests and results. For the objectives that matter to you, read the exceptions in full.
- User entity controls. Turn the list into tasks on your side.
- Subservice organizations. Note which vendors are carved out and what that leaves for you to cover.
03 · Exceptions
Reading exceptions against your accounts
An exception matters to you in proportion to its path to your numbers.
| Illustrative exception | Question for your financial reporting | Possible response |
|---|---|---|
| Two of forty pay rate changes lacked a documented approval | Could unauthorized rate changes have affected our payroll expense? | Review our own payroll changes for the period, or rely on our register review |
| A quarterly access review was performed late once | Could anyone have altered our data in the gap? | Ask the provider whether any inappropriate access was found; usually low impact |
| One program change was released without recorded testing | Did the change touch calculations we rely on? | Ask what the change was and whether outputs were checked after release |
| Reconciliation of bank confirmations was missed for a month | Could payments have failed without our knowing? | Agree that month's payments to our bank records |
Read management's response to each exception too. It often explains the cause and the fix, though it is management's view and is not tested. Your auditor decides what any exception means for their audit; your role is to give them the facts on your side.
04 · Your controls
Checking that your own controls are in place
The report assumes you do your part. Prove that you do.
- List every user entity control in the report that applies to how you use the service.
- Name an owner for each in your finance team.
- Keep evidence: signed reconciliations, approval records, review notes.
- If a CUEC does not fit how you work, raise it with the provider and your auditor early.
05 · Gaps and questions
Subservice coverage and what to ask the provider
Carved-out vendors and period gaps are where follow-up is most often needed.
- Which carved-out vendors handle your transactions, and can you obtain their reports?
- Does the period end leave a gap before your year-end? If so, ask for a bridge letter.
- Were there significant changes to the system during or after the period?
- Have any exceptions been fixed, and how would you know?
- When will the next report be issued, and for which period?
06 · Mistakes
Mistakes in reading a SOC 1
Most come from treating the report as a pass or fail stamp.
- Stopping at the opinion. A clean opinion can sit beside exceptions that matter for your accounts.
- Ignoring the CUEC list. The report's conclusions assume you perform them. If you do not, they may not hold for you.
- Accepting a SOC 2 instead. A security report does not speak to financial reporting objectives. It may help, but it is not a substitute.
- Missing the carve-outs. If the bank or host is carved out, nothing in the report tested it.
- Not checking the period. A report ending well before your year-end leaves months your auditor will ask about.
Sources: AICPA SSAE No. 18, AT-C section 320; AICPA SOC 1 guide and SOC suite pages; AICPA AU-C section 402; PCAOB AS 2601. Exceptions and responses are illustrative; your auditor makes the audit judgement.
Questions about reading a SOC 1
Who in our company should read the SOC 1?
Someone in finance who knows the outsourced process.
The controller or the owner of the process the provider runs is usually best placed. Your external auditor reads it too, but you are the one who knows which objectives touch your accounts.
How is this different from reading a SOC 2?
Same report structure, different questions.
A SOC 2 is read for security and data handling. A SOC 1 is read for its effect on your financial statements: the objectives, the period against your year-end, and your own CUECs. The SOC 2 reading guide covers the shared structure.
The report has a qualified opinion. Can our auditor still use it?
Often in part.
A qualification usually affects specific objectives. The rest may still be usable, and your auditor decides whether extra work is needed for the affected areas.
Can we share the report with others?
Usually not beyond your auditors.
SOC 1 reports are restricted use: intended for the provider, its clients and their auditors. Check the provider's terms before sharing further.
Get more out of the reports you receive.
We help finance teams review SOC 1 reports from providers and line up the user controls on their side.