SOC 1 by industry
Loan servicing: many owners rely on one set of books.
A servicer collects payments on loans it often does not own. Lenders, investors and trustees book interest income, principal balances and receivables from what the servicer reports. A SOC 1 gives them, and their auditors, evidence that the servicing records hold up between statements.
Back to SOC 2 services01 · Readers
Who reads a servicer's SOC 1
More readers than most SOC 1 reports, each looking for different balances.
- Loan owners
- Banks, credit funds and lenders whose loans you service. Their auditors test the balances and interest on their books.
- Investors
- Holders of loan pools who receive remittances and monthly reports from you.
- Trustees
- Parties that administer a securitisation and rely on your reporting to distribute cash to investors.
- Clients' auditors
- The user auditors who use your report as evidence about controls they cannot test directly.
In US securitisations, servicers may also give separate assessments of compliance with servicing criteria under other frameworks. Those are different engagements with different criteria, and a SOC 1 does not replace them.
02 · Activities
Servicing activities, objectives and the exceptions they attract
From boarding to default, each activity is a separate objective.
| Activity | Control objective (illustrative) | Exception commonly seen in testing |
|---|---|---|
| Loan boarding | New loans are set up completely and accurately from source documents | Rate or payment date keyed differently from the note, with no second check |
| Payment application | Payments are applied promptly and in the right order to principal, interest, escrow and fees | Partial payments held in suspense beyond the stated period |
| Escrow disbursement | Tax and insurance bills are paid accurately and before due dates | Late penalty because a tax bill was not tracked |
| Interest and fees | Interest accrues and fees are charged per loan terms | Rate reset missed on an adjustable loan |
| Investor reporting | Remittances and reports to investors are complete, accurate and timely | Reporting cut-off different from the remittance cut-off |
| Delinquency and default | Delinquent loans are identified and handled under approved procedures | Modification booked without documented approval |
03 · Escrow
Escrow: where servicers most often lose the thread
Money held for someone else's bill, on someone else's deadline.
Escrow accounts hold borrower money for property tax and insurance. The servicer must know every bill, pay it on time and keep each borrower's escrow balance right. An error here reaches the loan owner's books as a receivable or a liability, and sometimes as a penalty.
- Bill tracking. A complete list of tax and insurance due dates per loan, with a check for loans missing a due date.
- Disbursement approval. Payments released only after amounts are agreed to the bill and approved.
- Policy lapse monitoring. Insurance renewals tracked and lapses followed up within a set period.
- Periodic escrow analysis. Balances and future payments reviewed, with shortages and surpluses handled per the servicing procedures.
- Escrow bank reconciliation. The custodial account agreed to the sum of borrower escrow balances, with breaks investigated.
For US residential mortgages, consumer rules set how often escrow is analysed and how shortages and surpluses are treated. Where they apply, the description should say which rules your procedures follow.
04 · Interest and fees
Interest and fee calculation across loan types
The calculation engine is the same objective but a different risk per product.
Fixed-rate loans
Risk sits in set-up
- Errors usually come from boarding
- Once correct, the schedule rarely changes
- Testing focuses on boarding checks and interest recalculation
Adjustable and variable loans
Risk sits in change
- Each rate reset is a new chance of error
- Index feeds and caps must be applied correctly
- Testing samples resets and the source of the index
Late fees, modification fees and prepayment charges need their own rule set. Waivers should carry an approval, because a waived fee changes income the loan owner records.
05 · Investor remittance
Investor reporting and remittance
The step where servicing data turns into someone else's cash.
- Agreed cut-offsCollections, reporting and remittance follow the dates in each servicing agreement, documented per investor.
- Report-to-cash agreementThe amount remitted is agreed to the investor report before release.
- Custodial accountsCollections held in segregated accounts and reconciled to the servicing system.
- AdvancesWhere the servicer advances missed payments, the advance and its recovery are tracked per loan and investor.
06 · Scenario
An illustrative missed rate reset
One loan, one missed date, and three readers affected.
Illustrative: a variable-rate loan that kept its old rate
A batch of variable-rate loans boarded from a portfolio purchase arrives without reset dates in one field. The servicing system keeps charging the opening rate after the index rises. Borrowers underpay interest, investor reports show less income than the loans earned, and the loan owner's accrual is short. In a Type 2, the service auditor's sample of resets finds no reset where one was due. The report shows an exception under the interest objective, and management's response explains the boarding fix and the correction made. Each reader now decides what the exception means for its own books.
Sources: AICPA SSAE No. 18, AT-C section 320, as amended; AICPA Guide, SOC 1 Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting; references to consumer escrow rules and servicing criteria frameworks are general and flagged for confirmation. Activities, exceptions and the scenario are illustrative.
Questions loan servicers ask about SOC 1
Do subservicers need their own SOC 1?
Often, because the servicer above them relies on it.
If you subservice for another servicer, that servicer's report may carve you out and point readers to your report for the activities you perform.
Should default and foreclosure handling be in scope?
When it changes balances or income, usually yes.
Modifications, charge-offs and recoveries change what the loan owner records. Activities that only concern borrower contact, with no effect on balances, can sit outside the objectives.
Our document custodian is a separate firm. Does that matter?
It is a likely subservice organization.
If boarding relies on the custodian's records, describe it and the controls you assume it runs, and say how you monitor it.
Can a SOC 1 cover several investor agreements with different rules?
Yes, if the objectives are written at the right level.
Objectives can require remittance per the governing agreement, with the controls showing how each agreement's terms are captured and applied.
Test your servicing records before investors' auditors do.
We review boarding, escrow and remittance controls, draft objectives readers can map to their balances and prepare you for a CPA firm's examination.