SOC 1
SOC 1 in order: from first scope to issued report.
A SOC 1 schedule is set less by your own calendar than by your customers' auditors. They need a report that covers enough of their financial year, delivered in time for their audit. This page lays out the phases in order and shows how the period and customers' fiscal year-ends fix the dates.
Back to SOC 2 services01 · Work backwards
Start from the date your customers' auditors need the report
The issue date is the anchor. Every phase is placed behind it.
A user auditor, the customer's financial statement auditor, uses your SOC 1 as evidence about controls it cannot see directly. It cares about two things: whether the period covers its client's year well enough, and whether the report arrives before it signs off. So the practical question is not when you want to start but when the report must be in their hands.
Our SOC 2 timeline describes the general shape of an attestation project. The SOC 1 order below differs in where it begins: with the transaction flows and the control objectives management writes, and with a period chosen around other companies' year-ends.
02 · The phases
Eight phases, in the order they happen
Each phase has an output the next one depends on.
Scope
Decide what the report is about.
- What happens
- List the services and transaction classes that affect customers' books
- Collect customers' fiscal year-ends and any auditor requests
- You get
- A scope memo
- A shortlist of possible period dates
- Good practice
- Asking a few key customers what their auditors need
- Watch for
- Scoping every product because one customer asked broadly
Write the yardstick
Control objectives and the controls behind them.
- What happens
- Draft control objectives per transaction class and for IT
- Build the control matrix
- You get
- Approved objectives
- A first control matrix
- Good practice
- Objectives worded around what users rely on
- Watch for
- Copying a SOC 2 control list and calling it SOC 1
Readiness
Test yourself before anyone else does.
- What happens
- Walk through each flow
- Try to pull evidence for recent instances of each control
- You get
- A gap list with owners
- Good practice
- Testing evidence, not just reading policies
- Watch for
- Starting the period with open design gaps
Remediate and engage
Close gaps and appoint the CPA firm.
- What happens
- Fix design gaps and evidence trails
- Agree an engagement letter with a licensed CPA firm
- You get
- Controls ready to operate
- Agreed report type, system and period
- Good practice
- Engaging the firm early enough to book its staff
- Watch for
- Choosing the firm after the period has started without telling it
Type 1 date or period start
The clock begins.
- What happens
- For a Type 1, fix the as-of date
- For a Type 2, begin operating every control as described
- You get
- A defined start for the evidence
- Good practice
- Keeping evidence as it is created
- Watch for
- Changing controls without recording when
Fieldwork
The firm tests, often in more than one visit.
- What happens
- Walkthroughs, population checks and sample testing
- Testing of subservice monitoring and IT general controls
- You get
- Requests, follow-ups and any deviations
- Good practice
- One coordinator answering requests from a tracker
- Watch for
- Producing evidence recreated after the fact
Report and assertion
From test results to an opinion.
- What happens
- Finalise the description and sign the management assertion
- Sign the representation letter
- You get
- A draft report for factual review
- The issued report
- Good practice
- Reading every test result before signing
- Watch for
- Arguing the opinion instead of correcting facts
Distribute and bridge
Get the report to the people who need it.
- What happens
- Send the report to customers and their auditors under its use restriction
- Issue bridge letters for gaps to customers' year-ends
- You get
- A distribution log
- Signed bridge letters
- Good practice
- Planning the next period so it abuts this one
- Watch for
- Leaving a gap between periods that no letter can cover
03 · Period and fiscal year
How the period and customers' fiscal years drive the schedule
Choose the period end to suit the most customer year-ends you can.
A Type 2 period that ends far from a customer's year-end leaves its auditor with a gap. The gap is commonly covered by a bridge letter from management, which the CPA firm does not test. The shorter the gap, the more comfortable the user auditor. So look at where your customers' year-ends cluster before you pick dates.
| Illustrative customer base | Year-ends | A period end worth considering |
|---|---|---|
| Mostly Indian companies | Mostly 31 March, the Indian financial year | Close to 31 March, or a period that overlaps most of April to March |
| Mostly US companies | Commonly 31 December | Late in the calendar year, such as 30 September or 31 December |
| A mix | Spread across the year | One period end near the largest cluster, with bridge letters for the rest |
The standard does not fix a period length. What matters is whether user auditors can rely on it for their own year, so ask them before you settle on dates.
04 · Type 1 first?
Whether to start with a Type 1
A Type 1 can come sooner, but user auditors usually need operation over time.
Type 1 first
- Report on design as of a date
- Can be issued before any period has run
- Shows customers the description and design have been examined
- Rarely enough for a user auditor that wants to rely on controls
Straight to Type 2
- Report on design and operation over a period
- Cannot be issued until the period ends and testing is done
- The report user auditors generally ask for
- Leaves no room to discover design gaps mid-period
Type 1 and Type 2 are compared in depth on our SOC 1 types page.
05 · What slips
What pushes a SOC 1 schedule back
Most delays come from inputs, not from the examination itself.
- Objectives agreed late. The examiner cannot plan tests against a yardstick still being rewritten.
- A vendor report that does not arrive. Without it, the description and the vendor monitoring are incomplete.
- Populations that will not tie. If a list cannot be shown complete, sampling stalls.
- Controls changed mid-period without a record. The firm then has to test two designs, or cannot test one at all.
- A sponsor who leaves. Someone still has to sign the assertion and the representations.
Sources: AICPA SSAE No. 18, AT-C sections 105, 205 and 320, as amended; AICPA guide on SOC 1 examinations; AICPA auditing standard AU-C 402 and PCAOB AS 2601 on the user auditor's side, at the level summarised here. Customer bases and dates are illustrative.
Questions about SOC 1 timing
Should our period match our own financial year?
Only if it also suits your customers.
The report serves customers' auditors. Your own year-end matters less than where theirs fall. If they cluster on 31 March, a period near that date reduces the bridge letters you will need.
Can the period start before the CPA firm is engaged?
It can, but tell the firm and keep evidence intact.
The firm will test what happened across the whole period. If evidence for the early months is thin, it may suggest a later start. Engaging first avoids that surprise.
What happens after the first report?
The next period usually starts the day after.
Most service organizations run back-to-back periods so there is never an uncovered stretch, and issue bridge letters between the period end and customers' year-ends.
Why does this page give no durations?
Because they depend on your scope and your firm.
The number of transaction classes, systems, vendors and the CPA firm's own schedule all change the timing. We set dates with you once scope is known rather than quote a generic figure.
Set SOC 1 dates your customers' auditors can use.
We map your customers' year-ends to a period and a plan, then prepare each phase with your team.