SOC 1
Thirty questions to answer before you engage a CPA firm.
This is a self-test, not a list of documents. Each line is a statement you can mark yes or no, and each names the evidence that would prove a yes. Any no is a gap to fix or a scoping decision to make before a Type 1 date or a Type 2 period begins.
Back to SOC 2 services01 · How to use it
Answer from evidence, not memory
A yes counts only if you can hand over the item named.
- Pick one person to run the test and one to challenge each answer.
- Mark yes only when the named evidence exists today and covers the right systems.
- Mark no when the evidence is planned, partial or held in someone's head.
- Record a no with an owner and a target date, then re-run the whole list before the period starts.
What each document should contain is covered on our SOC 1 preparation page. This page only asks whether you have it and whether it would stand up.
02 · Scope
Scope
Five tests on what the report will cover.
- 1. Services named. The services in scope are listed and match what contracts promise. Evidence: a signed scope memo.
- 2. Relevance to customers' books. You can explain how each service affects customers' financial statements. Evidence: a short mapping of service to account or balance.
- 3. Transaction classes listed. Every class of transaction is named. Evidence: a list tied to the narratives.
- 4. Systems listed with reasons. In-scope and excluded systems are recorded with the reason for each. Evidence: a system inventory with an in or out column.
- 5. Report type and dates chosen. Type 1 date or Type 2 period agreed with leadership. Evidence: a dated decision note.
03 · Objectives and controls
Control objectives and controls
Six tests on whether the yardstick and the controls behind it are ready.
- 6. Objectives written. Each transaction class has at least one control objective. Evidence: an objectives list approved by management.
- 7. Objectives cover IT. Objectives exist for logical access, change management and computer operations where systems are in scope. Evidence: the same list.
- 8. Every objective has controls. No objective stands without at least one key control. Evidence: the control matrix.
- 9. Controls have owners. Each control names a role that performs it. Evidence: owner column completed.
- 10. Frequencies are true. The stated frequency matches what actually happens. Evidence: last three instances of each control.
- 11. Descriptions are testable. Each control says who does what, to what, how often, and what record it leaves. Evidence: matrix wording reviewed by someone outside the team.
04 · Evidence
Evidence and populations
Seven tests on whether a sample could actually be pulled and checked.
- 12. Populations can be extracted. Each recurring control has a full list for any date range. Evidence: a trial extract.
- 13. Extracts are repeatable. The query or report steps are written down. Evidence: an extraction guide.
- 14. Key reports are trusted. Reports a control relies on have been checked for completeness and accuracy. Evidence: a tie-out record.
- 15. Reviews are signed and dated. Manual reviews leave a sign-off with date and reviewer. Evidence: a sample of last month's reviews.
- 16. Access is controlled. User lists, joiners, leavers and periodic reviews exist for every in-scope system. Evidence: the latest review with sign-off.
- 17. Changes are controlled. Changes to in-scope systems carry approval and testing, and deployers are separated from developers or the exception is mitigated. Evidence: change tickets.
- 18. Job failures are handled. Failed batch runs raise an alert and leave a resolution record. Evidence: an incident or rerun log.
05 · Vendors
Vendors and subservice organizations
Four tests on the providers behind your service.
- 19. Vendors identified. Every vendor that performs part of a key process or hosts in-scope systems is listed. Evidence: a vendor register.
- 20. Presentation decided. Carve-out or inclusive is chosen for each subservice organization. Evidence: a note per vendor.
- 21. Reports in hand. A current SOC 1 or equivalent exists for each, with a period that overlaps yours. Evidence: the reports, filed.
- 22. Reviews recorded. Someone has read each report's opinion, exceptions and user controls and recorded the result. Evidence: a review form.
06 · User entity controls
Complementary user entity controls
Four tests on what customers must do for your controls to work.
- 23. CUECs listed. Controls you assume customers perform are written down. Evidence: a CUEC list.
- 24. Linked to objectives. Each CUEC names the objective it supports. Evidence: the matrix dependency column.
- 25. Told to customers. Customers are informed of their responsibilities. Evidence: contract clauses, onboarding material or a help-centre page.
- 26. Realistic. Each CUEC is something a customer's finance team can actually do and evidence. Evidence: review by client services.
07 · Governance
Governance and the assertion
Four tests on the people who will stand behind the report.
- 27. A sponsor. A named executive owns the SOC 1 and will sign the assertion. Evidence: an assignment in writing.
- 28. Risk assessment. Risks that could misstate customer outputs have been assessed recently. Evidence: a dated risk assessment.
- 29. Monitoring. Someone checks that key controls ran, and acts when they did not. Evidence: monitoring notes or a controls dashboard.
- 30. Draft description and assertion. Both exist in draft and match the matrix. Evidence: the drafts, version-dated.
08 · Reading your result
What your answers usually mean
Where the no answers cluster tells you what to do next.
| Where most no answers fall | What it usually means | Sensible next step |
|---|---|---|
| Scope (1 to 5) | The report's subject is not yet settled | Settle scope first; nothing else can be finished without it |
| Objectives and controls (6 to 11) | The yardstick or the controls are not written | Draft objectives, then the matrix, then test wording |
| Evidence (12 to 18) | Controls may run but cannot be proven | Fix extraction and sign-off before any period starts |
| Vendors (19 to 22) | The description cannot be completed | Collect reports and decide carve-out or inclusive |
| User entity controls (23 to 26) | Customers may not know their part | List CUECs and update customer material |
| Governance (27 to 30) | No one is ready to sign | Name a sponsor and set a review rhythm |
- Preparing for a SOC 1 examinationWhat to have ready before fieldwork starts.
- The readiness assessment, step by stepWhat it produces, what it doesn't, and how to use the result.
- SOC 1 phases from scoping to reportThe order of work, from scoping to the issued report.
Sources: AICPA SSAE No. 18, AT-C sections 105, 205 and 320, as amended; AICPA guide on SOC 1 examinations; AICPA SOC suite of services pages. The checklist is our own working tool, not an AICPA list.
Questions about the readiness checklist
How many no answers is too many to start?
It depends on which ones.
A no on scope or objectives blocks everything else. A handful of no answers on evidence can be fixed before a period starts. There is no pass mark; the nature of the gaps matters more than the count.
Is this the same as a readiness assessment?
No. It is the test you run on yourself first.
A readiness assessment has someone independent of the work examine your controls and evidence in depth. This checklist tells you whether you are ready to ask for one.
Does the CPA firm use this list?
No. The firm follows its own methodology.
The items reflect what an examination under AT-C 320 needs, but the firm's requests are its own. Treat this list as preparation, not as a promise of what will be accepted.
Should we run it again later?
Yes, before the period starts and once during it.
Systems, people and vendors change. Re-running the list mid-period catches a new tool or a departed owner while there is still time to keep evidence intact.
Turn your no answers into evidence.
We run this test with your team, then help close each gap before a SOC 1 period begins.