SOC 1
SOC 1 and Sarbanes-Oxley: your report, your client's section 404.
Sarbanes-Oxley applies to your listed clients, not to you. Yet their section 404 work reaches into your systems whenever you run part of their financial process. A SOC 1 is how that reach is usually satisfied, and it helps to know exactly where it stops.
Back to SOC 2 services01 · Section 404
What section 404 asks, and of whom
Duties fall on the issuer and its auditor. A service provider is not named.
- Section 404(a)
- Each annual report of a public company carries a report from management stating its responsibility for internal control over financial reporting (ICFR) and assessing how effective that control was at the end of the fiscal year.
- Section 404(b)
- The company's registered public accounting firm attests to and reports on management's assessment, as part of the same audit.
- Exemptions from 404(b)
- Issuers that are neither accelerated nor large accelerated filers, and emerging growth companies, are excluded from the auditor attestation. Management's own assessment still applies.
Section 404 is codified at 15 U.S.C. 7262. It speaks to issuers and their auditors; nothing in it requires a service provider to hold any report.
02 · Outsourced controls
Outsourcing a process does not outsource the responsibility
Your client's management answers for controls you run on its behalf.
If your platform calculates a client's payroll or services its loans, the controls in that platform are part of the client's ICFR. The client's management cannot leave them out of its assessment because another company performs them. It needs evidence that they work, and a SOC 1 Type 2 is the standard form of that evidence.
Where the SEC's guidance points
The SEC's interpretive guidance for management on evaluating ICFR expects management to consider controls at service organizations, and recognises a service auditor's report as one way to obtain evidence about them.
03 · Into the 404 file
How your SOC 1 enters a client's 404 file
Six steps on the client's side, none of which you perform.
- The client maps its significant accounts and finds the processes you run.
- It obtains your SOC 1 and checks that the services, locations and objectives match what it uses.
- It compares your period with its fiscal year and asks for a bridge letter for the gap.
- It reads the exceptions and decides whether any affect its accounts.
- It tests its own complementary user entity controls, the ones your report says it must run.
- Its auditor reviews that work under the PCAOB's standards, including AS 2601 on service organizations and AS 2201 for the audit of ICFR.
04 · User controls
Complementary user entity controls carry real weight
Your report assumes the client does certain things. In a 404 file, those get tested.
| Illustrative user control | Who runs it at the client | Why it matters to 404 |
|---|---|---|
| Approve pay changes before the cut-off | HR or payroll lead | Your controls assume the input is authorised |
| Review the payroll register before funding | Finance | Catches errors your controls do not see |
| Remove leavers' access to your portal | Client administrator | Your access controls stop at the client's own users |
| Reconcile your reports to the ledger | Accounting | Proves your output was posted completely |
If these are vague in your description, the client cannot test them and its auditor cannot close the loop. Write each one so that a client could show it happened.
05 · What it is not
What a SOC 1 does not do
Most confusion comes from reading SOX into the report.
- It is not a SOX audit of you. It is an examination of controls relevant to your clients' ICFR, under AT-C section 320.
- It does not make you SOX compliant. Unless you are an issuer yourself, there is nothing for you to comply with under section 404.
- It is not an opinion on the client's ICFR. Only the client's management and its auditor reach that conclusion.
- It does not cover the client's own controls. Complementary user entity controls are listed, not tested.
- It does not cover months after the period. A bridge letter is management's statement, with no CPA procedures behind it.
06 · If you are private
If you are the private company in the middle
Your obligation is contractual, not statutory.
An Indian provider serving a US-listed client has no section 404 duty of its own. What it has is a contract, which may require a SOC 1 Type 2 each year, a set period, bridge letters on request and notice of significant changes. Read those clauses before scoping, because they fix the period and the services the report must cover.
This page explains how the pieces fit. It is not legal advice; counsel should confirm how section 404 and your contracts apply to you and your clients.
Sources: Sarbanes-Oxley Act of 2002, section 404 (15 U.S.C. 7262); AICPA SSAE No. 18, AT-C section 320; AICPA SOC 1 page; PCAOB AS 2601 and AS 2201; SEC interpretive guidance for management on ICFR (2007). User controls are illustrative.
Questions about SOC 1 and SOX
Does SOX require our company to have a SOC 1?
No. The law does not name service providers.
Section 404 places duties on issuers and their auditors. Your clients may still require a SOC 1 in their contracts so they can meet their own duty.
Can our client's auditor test our controls instead of using a report?
Yes, though it is rarely convenient for anyone.
Without a usable report the auditor may need procedures at your site. With many listed clients, a single SOC 1 avoids repeating that work for each one.
Our report had exceptions. Does that fail the client's 404 assessment?
Not automatically.
The client and its auditor judge whether the exception affects a significant account and whether other controls compensate. Clear management responses help them make that call.
We are not a US company. Does this still apply?
It applies through your US-listed clients.
Section 404 binds issuers, wherever their providers sit. If your client files with the SEC, its management needs evidence about your controls.
Give your listed clients evidence their 404 work can use.
We prepare control objectives, user controls and evidence shaped for clients under section 404, ready for the CPA firm's examination. Counsel should confirm how the law applies to your contracts.