SOC 1
Five parties, one report: who does what in a SOC 1.
A SOC 1 is written by one firm, about one company, for readers that company may never meet. This page names each party, sets out what it relies on and what it owes, and follows a report from fieldwork to a client's audit file. What the report itself covers is on a separate guide.
Back to SOC 2 services01 · The cast
The five parties and the role each plays
Two of them never sign anything, yet the report is written for them.
- Service organization
- The provider whose system is examined: a payroll bureau, a loan servicer, an outsourced accounting team. Its management writes the description and signs a written assertion.
- User entities
- The provider's clients. Their financial statements contain numbers that passed through the provider's system.
- User auditors
- The firms that audit those clients' financial statements. They read the SOC 1 as audit evidence about controls that sit outside the client's walls.
- Service auditor
- The licensed CPA firm that examines the provider under AT-C section 320 and signs the opinion. It is independent of the provider.
- Subservice organizations
- Vendors the provider itself relies on, such as a data centre or a print-and-mail house, whose controls matter to the same objectives.
| Party | Relies on | Owes |
|---|---|---|
| Service organization | The CPA firm's opinion to answer many client audits at once | An accurate description, a signed assertion, evidence on request, and honest disclosure of exceptions |
| User entity | The report to show that outsourced steps are controlled | The complementary user entity controls the provider's design assumes, and a copy of the report to its auditor |
| User auditor | The opinion, the tests and the results, for the period that overlaps its client's year | Its own judgement on whether the report is fit for its audit; it is not bound to accept it |
| Service auditor | Management's assertion and the evidence the provider supplies | An independent examination under the AICPA attestation standards |
| Subservice organization | Its own contract with the provider | The controls the provider's description assumes of it, often shown through its own SOC report |
02 · How it travels
How a report moves from fieldwork to a client's audit file
Six hand-offs, and the report changes hands at each one.
- Provider management decides the scope, writes the control objectives and the system description, and signs the assertion.
- The CPA firm examines the description and the controls, tests them (for a Type 2), and issues its report with the opinion.
- The provider shares the report with its clients, usually through a portal or on request, under the report's restricted-use terms.
- Each client's finance team reads it, checks that its own complementary controls are running, and passes it to its auditor.
- The user auditor checks the period, the opinion, the exceptions, the subservice treatment and the complementary controls against its client's year.
- The user auditor decides how far it can rely on the provider's controls, and plans its own testing around what the report does not cover.
The provider and the user auditor often never speak. Everything the user auditor learns arrives through the report and the client, which is why the description has to stand on its own.
03 · Reliance
Reliance runs in one direction
The report lets an auditor use evidence; it never hands over the auditor's judgement.
What the report gives the user auditor
- An independent opinion on the description and the design of controls
- For a Type 2, the tests performed and their results, exceptions included
- The list of controls the client is expected to run itself
What the user auditor still does
- Judges whether the objectives cover the client's relevant assertions
- Tests the client's complementary controls at the client
- Weighs exceptions, the gap after the period and any carved-out vendor
A clean opinion is the start of the user auditor's work, not the end of it.
The user auditor follows its own standard on clients that use service organizations: AU-C section 402 for audits under AICPA standards, and the PCAOB's AS 2601 for audits of public companies. Those standards shape what it looks for in your report.
04 · Subservice vendors
The vendor behind the vendor
A subservice organization is in the chain whether or not its controls are in the report.
If your payroll engine runs in a third party's data centre, that data centre affects the same objectives your clients care about. The description must name it and say how it is presented: carve-out, where its controls are left out and the controls you assume of it are listed, or inclusive, where its controls are described and tested alongside yours. The method changes what the user auditor has to collect elsewhere. The choice itself has its own guide.
What a carve-out sends downstream
Under a carve-out, a careful user auditor will want the subservice organization's own report too. Your clients will ask you for it, so know where to get it before they do.
05 · An example
Illustrative: one payroll run seen from five desks
The same monthly run means something different to each party.
| Desk | What it sees in the month-end payroll run |
|---|---|
| Payroll provider | Rate changes approved, the run calculated, the bank file sent, the register delivered |
| Client finance team | Pay data approved before the cut-off, the register reviewed, the expense posted |
| Client's auditor | Whether payroll expense and liabilities are complete and accurate for the year |
| CPA firm (service auditor) | Samples of approvals, run checks and file transfers across the period |
| Hosting vendor (subservice) | Physical security and availability of the servers the engine runs on |
Illustrative only. A real description sets its own objectives and controls.
06 · Where it breaks
Where the chain usually breaks
Most problems are hand-off problems, not control failures.
- The report never reaches the auditor. The client's finance team files it and the auditor asks the provider again at year-end. Tell clients who the report is for.
- Clients do not know their part. Complementary user entity controls buried in the description go unread. Send them as a short list with the report.
- A carved-out vendor with no report. The user auditor has nothing to look at for that vendor. Find out early whether one exists.
- Assuming the CPA firm will explain it. The service auditor's duty runs to the examination. Client questions about scope come back to you.
Sources: AICPA SSAE No. 18, AT-C sections 105, 205 and 320; AICPA SOC 1 page (SOC for Service Organizations: ICFR); AICPA AU-C section 402; PCAOB AS 2601. Scenarios are illustrative.
Questions about the parties to a SOC 1
Is the CPA firm that examines us our auditor?
It is the service auditor, not your financial-statement auditor.
The service auditor examines the controls described in your SOC 1. Your own company accounts, if audited, are a separate engagement, and the firms are often different.
Can a client's auditor ask to test our controls directly?
It can ask; a report usually makes that unnecessary.
Without a usable report, a user auditor may ask for access or for procedures at your site. A SOC 1 exists so that one examination answers many such requests.
Who engages and pays the CPA firm?
The service organization.
The provider engages the service auditor and receives the report. Clients and their auditors are the intended readers but are not party to the engagement.
Can our client pass the report to its lenders or investors?
Not as a rule; the report is restricted use.
A SOC 1 is meant for your management, your clients and their auditors. Wider sharing depends on the report's own use wording, so check it with the CPA firm before agreeing.
Does a clean opinion oblige the user auditor to rely on us?
No.
The user auditor decides for itself whether the report is adequate for its audit, looking at the period, the scope and the exceptions.
Know every party before the CPA firm arrives.
We map your clients, their auditors and your vendors to the report, and prepare the description and controls the CPA firm will examine.