SOC 1
SOC 1 and ISO 27001: a report on financial controls, a certificate for a security system.
Both involve an independent examiner and a stack of evidence, so they get compared. They answer different people. A SOC 1 tells a client's financial auditor that your controls over their numbers work. An ISO 27001 certificate tells a buyer you run an information security management system that meets the standard.
Back to SOC 2 services01 · Different questions
Each one answers a different question
Start from the question, not the badge.
SOC 1
Can our auditor rely on your controls over our books?
- Controls relevant to clients' financial reporting
- Objectives written by your management
- An opinion with tests and results (Type 2)
ISO/IEC 27001
Do you manage information security systematically?
- A management system for information security
- Requirements in clauses 4 to 10, with Annex A controls chosen by risk
- A certificate stating conformity, with a defined scope
02 · Side by side
A side-by-side comparison
Different issuers, different outputs, different lifecycles.
| SOC 1 | ISO/IEC 27001 | |
|---|---|---|
| What it is | An attestation report | A certification against a management-system standard |
| Governing rules | AICPA SSAE No. 18, AT-C sections 105, 205 and 320 | ISO/IEC 27001:2022; audits run under ISO/IEC 17021-1 and 27006 |
| Who issues it | A licensed CPA firm | An accredited certification body |
| Yardstick | Control objectives set by management | The standard's requirements and your Statement of Applicability |
| Output | Opinion, description, and for Type 2, tests and results | A certificate naming the scope, plus an audit report kept by you |
| Time covered | A date (Type 1) or a period (Type 2) | A certificate cycle with surveillance audits in between |
| Main reader | Clients' financial auditors | Customers, partners and procurement teams |
| Sharing | Restricted use | The certificate can be shown publicly |
A certificate cycle commonly runs three years, with surveillance audits each year and a recertification audit at the end.
03 · Shared evidence
Where the evidence overlaps
Many IT controls serve both; the reason they are tested differs.
| Control area | In a SOC 1 | In ISO 27001 (Annex A name) |
|---|---|---|
| Access to systems | Stops unauthorised changes to financial data | 5.15 Access control; 5.18 Access rights |
| Changes to software | Protects the accuracy of calculations | 8.32 Change management |
| Backups | Records can be restored completely | 8.13 Information backup |
| Logs and monitoring | Shows who changed what, and when | 8.15 Logging |
| Vendors | Subservice organizations and the controls assumed of them | 5.19 Information security in supplier relationships |
Keep one control register. Tag each control with the SOC 1 objective and the Annex A control it supports, and collect evidence once on a calendar both examiners can sample. The financial side of a SOC 1, such as reconciliations and calculation checks, has no ISO counterpart and stays on its own list.
04 · Not a substitute
Why one does not stand in for the other
Each misses what the other's reader needs most.
- A user auditor needs tested evidence about controls over its client's transactions. An ISO certificate says nothing about those transactions and carries no test results.
- An ISO buyer wants assurance about your security management. A SOC 1 is restricted use and is limited to financial-reporting objectives.
- A SOC 1 objective is set by you. ISO 27001 requires the management system to cover the scope you certify, risk assessment included.
05 · Needing both
When a provider needs both
Usually when finance customers and security-led buyers sit in the same pipeline.
- Financial clients outside the USSome buyers ask for ISO 27001 for security and a SOC 1 for their auditors.
- Regulated customersBanks and insurers often ask for a security certificate in onboarding and a SOC 1 for year-end.
- An existing certificateAn ISMS already in place gives a SOC 1 a head start on access, change and backup evidence.
- Large outsourcing contractsContracts for processing work often list both, with separate clauses for each.
- Confirm what each customer group actually requires.
- Build one control register and map it both ways.
- Line up the SOC 1 period with the ISO audit calendar so evidence is gathered once.
- Engage a CPA firm for the SOC 1 and an accredited certification body for ISO 27001; they are different bodies.
Sources: AICPA SSAE No. 18, AT-C sections 105, 205 and 320; AICPA SOC 1 page; ISO/IEC 27001:2022 (clause and Annex A control titles only); ISO/IEC 17021-1 and ISO/IEC 27006 on certification audits. Mappings are illustrative and in our own words.
Questions about SOC 1 and ISO 27001
Will a client's auditor accept our ISO 27001 certificate instead of a SOC 1?
Rarely, for reliance on financial controls.
The certificate shows a management system exists. It does not test controls over the client's transactions over a period, which is what the auditor needs.
Is ISO 27001 closer to SOC 1 or to SOC 2?
To SOC 2.
Both ISO 27001 and SOC 2 address information security. A SOC 1 addresses financial reporting, so its overlap with ISO is limited to general IT controls.
Can one firm deliver both?
Only if it holds both standings.
A SOC 1 needs a licensed CPA firm; an ISO certificate needs an accredited certification body. Some groups have both arms, but they are separate engagements.
Which should we do first?
The one blocking revenue or an audit.
If a client's auditor is waiting, start with SOC 1. If security reviews are stalling deals, start with ISO 27001 or SOC 2 and reuse the IT controls later.
Run one control set for both examiners.
We build a single control register and evidence calendar that serves a SOC 1 and an ISO 27001 audit, and prepare you for the CPA firm and the certification body.