SOC 1 by industry
Outsourced finance: your team does the work, the client signs the accounts.
When a business hands its payables, receivables or month-end work to an outside team, its auditor still has to trust the result. A SOC 1 for a BPO describes a standard way of working that many clients share, and shows which client-specific steps the report does not reach.
Back to SOC 2 services01 · Assertions
Objectives that point at the client's financial statement assertions
A client's auditor thinks in assertions. Write objectives they can match.
An auditor tests whether account balances and transactions are complete, actually occurred, are accurate, sit in the right period and are classified correctly. A BPO objective is easier to use when it names the assertion it supports.
| Assertion | Payables example | Receivables example | Objective wording (illustrative) |
|---|---|---|---|
| Occurrence | Only valid supplier invoices are recorded | Invoices raised only for goods or services delivered | Transactions processed are supported by client-approved documents |
| Completeness | Every invoice received is logged | Every cash receipt is applied | All documents received are recorded and tracked to completion |
| Accuracy | Amounts agree to invoice and order | Receipts applied to the right customer | Data entered agrees to source documents |
| Cut-off | Invoices booked in the right month | Receipts recorded on the date received | Items are processed in the period set by the client's calendar |
| Classification | Expense coded to the right account | Credits split from receipts | Coding follows the client's chart of accounts and rules |
02 · Processes
The processes a finance BPO usually puts in scope
Each one gets controls a service auditor can sample per client.
- BPO.1Document intakeEvery document from a client is logged with a date and reference on arrival, and the log is reconciled to what was processed.
- BPO.2Data entry qualityA reviewer checks a defined share of keyed items against source, with errors tracked by operator.
- BPO.3Vendor master changesNew suppliers and bank detail changes need client approval and a call-back or equivalent check before use.
- BPO.4Payment preparationPayment proposals go to the client for release; the BPO prepares but does not approve.
- BPO.5Receipts applicationUnapplied cash is reported to the client each cycle with ageing.
- BPO.6ReconciliationsBank and control account reconciliations prepared by one person and reviewed by another, with open items carried forward visibly.
- BPO.7Close supportAccruals and journals prepared from a close checklist agreed with each client and sent for client approval.
03 · Many clients
One report, many clients with different rules
The report covers your standard process; each client's own rules sit around it.
Inside the report
What every client gets
- The common workflow and tooling
- Quality review, access and change controls
- How client instructions are captured and kept current
Outside the report
What each client agrees with you
- Client-specific approval limits and coding rules
- Bespoke reports and reconciliations
- Steps performed in the client's own system under its controls
A useful middle path is an objective over client instructions: each client's procedures are documented, approved by the client and updated under change control. The report then tests that you follow the documented procedure, without listing every client's rules.
04 · Delivery centres
Offshore and multi-site delivery
The description has to say where the work happens and whether every site is in scope.
- Sites named. Each delivery location that processes in-scope work is listed in the description.
- Same controls everywhere. Controls that differ by site are described as different, not assumed to match.
- Remote access to client systems. How staff reach each client's ERP, and who grants and removes that access, is explained.
- Staffing changes. Joiner, mover and leaver steps are tied to client system access, not only your own.
- Sampling across sites. Expect the service auditor to sample from more than one location if work is spread.
Where your team works inside the client's own accounting system, access to that system is often a complementary user entity control: the client grants and reviews it. Say so, or your report appears to promise something you do not control.
05 · Traps
Traps for outsourced finance providers
The common ones come from client-specific work sliding out of view.
- Client procedures outside scope, but relied on. A client's auditor assumes a bespoke three-way match is covered. If it is not in the description, it was not tested. Tell the client early.
- Instructions by email only. Rule changes agreed in a mail thread and never written into the client's procedure leave nothing to test.
- Vendor bank changes taken on trust. A request that looks like it came from a supplier, applied without a check, is both a fraud risk and an exception.
- Preparer and reviewer on the same team shift. Review evidence that is a tick from the same person fails under sampling.
- Approval drifting to the BPO. If your staff start releasing payments for a client, the controls and the report must change, or the description is no longer accurate.
06 · Scenario
An illustrative scope conversation
A client asks why its special process is missing from the report.
Illustrative: a retail client's rebate accrual
A BPO runs payables for forty clients under one standard process. One retail client also has the team calculate supplier rebate accruals using a spreadsheet the client designed. The SOC 1 covers intake, entry, vendor master and payment preparation, but not the rebate calculation. The client's auditor reads the description, sees the gap and tests the accrual directly at the client. Nothing in the report was wrong. The lesson is to tell each client, in writing, which of its tasks the report covers and which it does not.
Sources: AICPA SSAE No. 18, AT-C section 320, as amended; AICPA Guide, SOC 1 Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting; AU-C section 315 for financial statement assertions as commonly described. Processes, controls and the scenario are illustrative.
Questions BPO and outsourcing firms ask about SOC 1
Our team works inside each client's ERP. What does our report cover?
Your people, procedures and reviews, not the client's system.
The report covers how your staff perform the work: intake, entry, review and escalation. The client's system and its access settings usually remain the client's controls.
Can we include only our largest clients' processes?
The scope follows services, not client names.
A report describes a service and the controls over it. If a process is offered to many clients, it is described once; a bespoke process for one client is usually left out or covered separately.
Do our delivery centres in India need separate reports?
Not necessarily.
One report can cover several sites if the description names them and explains any differences in controls. Expect the CPA firm to sample from each site that matters.
Is a SOC 1 enough for clients with data protection concerns?
No. It addresses financial reporting.
Questions about confidentiality and personal data are better answered by a SOC 2 and by the data protection terms in your contract.
Draw the line between your process and theirs.
We document your standard service, separate client-specific work, and test the controls a CPA firm will sample across your sites.