SOC 1
A SOC 1 lets your client's auditor rely on you without a visit.
A company that hands payroll, loan servicing or fund accounting to an outside provider still needs its own auditor to understand the controls over that work. Sending every auditor to every provider would be slow and costly. A SOC 1 fixes that: one examination of the provider, read by many audit teams. This page follows the report from the provider's desk to the auditor's working papers.
Back to SOC 2 services01 · Why it exists
The visit the report saves
Auditing standards expect a client's auditor to understand outsourced processing. A SOC 1 is the usual route.
Picture a retailer that outsources payroll. Salary cost is one of the largest lines in its accounts, and every figure comes out of someone else's system. The retailer's auditor has to understand how that provider's controls bear on those figures. The US standards written for these user auditors, AU-C 402 for private-company audits and PCAOB AS 2601 for listed companies, set out the choices: test the provider directly, or obtain a report from the provider's own service auditor.
One report, many audit teams
A provider with two hundred clients could otherwise face two hundred audit teams asking near-identical questions. A single SOC 1 answers them together, and each auditor decides for itself how far to rely on it.
02 · The reliance chain
Four hands the report passes through
Each party adds something, and a weak link anywhere limits what the last reader can rely on.
The provider's management
Sets the yardstick and describes the system.
- What happens
- Writes control objectives tied to clients' financial figures
- Drafts the system description and signs a written assertion
- You get
- A description and objectives ready to be examined
- Good practice
- Objectives that cover the risks a client's auditor would care about
- Watch for
- Objectives lifted from a security framework with no path to financial figures
The service auditor
A licensed CPA firm examines the description and the controls.
- What happens
- Judges whether the objectives are suitable
- Tests design, and for a Type 2, operation across the period
- You get
- An opinion, plus in a Type 2 the tests run and their results
- Good practice
- Independence from whoever built the controls
- Watch for
- A report still badged with a retired standard such as SSAE 16
The user entity
The client company that receives the report.
- What happens
- Checks that the report covers the services and months it relies on
- Runs the user entity controls the report assigns to it
- You get
- Comfort that its outsourced processing is under control
- Good practice
- A named owner for every user control
- Watch for
- Filing the report without reading it
The user auditor
The client's financial statement auditor.
- What happens
- Weighs any exceptions against the client's own risks
- Covers months outside the report period, often with a bridge letter
- You get
- Evidence for its audit of the client's accounts
- Good practice
- A report period that spans most of the client's financial year
- Watch for
- Leaning on a report whose period closed long before the year-end
03 · The rulebook
The standards a SOC 1 rests on
One AICPA statement, several sections inside it, and an international twin.
| Name | What it is | What it means for a SOC 1 |
|---|---|---|
| SSAE 18 | The AICPA statement that regrouped the attestation standards into AT-C sections; it applies to reports dated on or after 1 May 2017 | The current base; it replaced SSAE 16, which had itself replaced SAS 70 |
| AT-C 105 | Ground rules shared by every attestation engagement | Independence, acceptance and quality expectations |
| AT-C 205 | Rules for examinations in which management gives an assertion | The examination form a SOC 1 takes |
| AT-C 320 | The section for service organizations whose controls bear on clients' financial reporting | Sets what the description must hold and how the report is laid out |
| SSAE 21 | A later statement that reworked the examination rules and introduced direct examinations; it applies to reports dated on or after 15 June 2022 | A SOC 1 stays an examination built on management's assertion |
| ISAE 3402 | The international standard for the same kind of report | Some firms issue one report under both, so auditors outside the US can use it |
No SOC 2 counterpart to AT-C 320 exists. A SOC 2 runs under AT-C 105 and 205, measured against the Trust Services Criteria, with DC 200 governing its description. DC 200 plays no part in a SOC 1.
04 · Versus SOC 2
Where a SOC 1 parts ways with a SOC 2
The examination mechanics match. The yardstick, the reader and the idea of failure do not.
- Who writes the yardstick
- In a SOC 1, management drafts the control objectives and the auditor decides whether they suit clients' financial reporting. In a SOC 2 the AICPA has already written the criteria.
- What the description must hold
- AT-C 320 asks for the path a transaction takes from start to client report, the records behind it, how unusual events such as a failed batch are dealt with, and how reports to clients are produced. A SOC 2 description follows DC 200 instead.
- Who reads the result
- Client finance teams and their auditors, under a restricted-use clause. A SOC 2 goes to security and procurement reviewers.
- What counts as a problem
- A control gap matters when it could let an error reach a client's figures. A pure security weakness with no route to financial data may sit outside a SOC 1 altogether.
05 · Go deeper
The SOC 1 guides, one topic each
This page is the overview. Each linked guide takes one part further.
- Control objectives in a SOC 1How to write them, and why they come before the controls.
- The SOC 1 system descriptionWhat the description must say, and how it is tested.
- User entity controls in a SOC 1What clients must do for your controls to work.
- Subservice organizations in a SOC 1Carve-out or inclusive for the vendors behind your service.
- SOC 1 bridge lettersCovering the gap after a period ends, for a client's auditor.
- SOC 1 Type 1 vs Type 2Design at a date or operation over a period, and what auditors want.
Sources: AICPA, SOC 1 page in the SOC suite of services; AICPA, SSAE 18 (AT-C sections 105, 205 and 320); AICPA, SSAE 21; IAASB, ISAE 3402; AICPA, AU-C section 402; PCAOB, AS 2601.
06 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
Questions providers ask about SOC 1
Our service has nothing to do with accounting. Could anyone still want a SOC 1?
Only if your work feeds a client's financial figures.
The test is whether a mistake in your service could flow into a client's financial statements. A hosting provider seldom meets it; a billing or payroll engine usually does. The guide on who needs a SOC 1 works through the test in more detail.
How does a client's auditor cover the months after our report ends?
Usually with a bridge letter plus procedures of their own.
Management can issue a bridge letter saying whether anything material changed after the period. The CPA firm does not examine it, so the client's auditor decides how much weight it carries.
Can we borrow another provider's control objectives?
Borrow the shape, not the content.
Objectives have to fit your services and the risks to your clients' figures. The service auditor judges whether they are suitable, and objectives taken from a different business tend to miss what your own clients depend on.
Do we need a Type 2 straight away?
Most client auditors prefer one; a Type 1 can come first.
A Type 1 shows design on a single date and can satisfy a first request. Auditors who rely on your controls for a whole year usually want a Type 2 spanning most of it.
Working out whether you need a SOC 1, a SOC 2 or both?
We map your services to clients' financial reporting and prepare the objectives, controls and description for the CPA firm.