SOC 1
Does your service need a SOC 1? Start from your client's ledger.
The question is not how big you are or how sensitive your data is. It is whether something you do ends up as a number in a client's financial statements. If it does, that client's auditor will want evidence about your controls, and a SOC 1 is the usual form.
Back to SOC 2 services01 · The test
One question, broken into five
If you answer yes to any of these, keep reading. If all five are no, a SOC 1 is unlikely.
- Do you process transactions for clients?. Payroll runs, claims, payments, trades, invoices: anything that becomes an entry in their books.
- Do you keep records they report from?. Shareholder registers, loan balances, policy records, fund holdings.
- Do you calculate amounts they post?. Interest, commissions, revenue schedules, tax, depreciation.
- Do you move money for them?. Collections, disbursements, settlement or escrow.
- Would they notice your error before it reached their accounts?. If not, their auditor will see your controls as part of theirs.
02 · Service types
Common service types, sorted
A rough sort. The same service can move columns depending on what a client uses it for.
| Service | SOC 1 need | Why |
|---|---|---|
| Payroll processing | Likely | Payroll expense, withholdings and liabilities come straight from the provider's output |
| Insurance claims administration | Likely | Claims paid and reserves feed the insurer's or employer's statements |
| Loan and mortgage servicing | Likely | Balances, interest and escrow sit in the lender's or investor's books |
| Transfer agents and registrars | Likely | The shareholder record supports equity and distributions |
| Outsourced accounting and bookkeeping | Likely | The provider is doing part of the client's financial close |
| Fund administration | Likely | Valuations and investor balances are the fund's financial statements |
| SaaS with a calculation engine | Depends | Billing, revenue recognition or tax engines can be in scope when clients post their output without recalculating |
| Payment processing | Depends | Likely where clients record revenue or cash from the processor's settlement reports |
| Cloud hosting or data centre | Depends | Usually a subservice organization in someone else's SOC 1 rather than the subject of one |
| Collaboration, CRM or marketing tools | Unlikely | Little bearing on what clients report, though a SOC 2 may be asked for |
Illustrative sort, not a ruling. The deciding factor is how each client's auditor sees the flow.
03 · The client side
Why your clients matter as much as your service
Demand comes from audited clients for whom your flow is significant.
- Audited clientsA client with no financial-statement audit has no user auditor to ask. Listed and lender-backed clients almost always have one.
- Public companiesClients subject to Sarbanes-Oxley section 404 have to assess their controls over financial reporting each year, outsourced steps included.
- Significance of the flowIf your output is a large share of a client's expenses, revenue or balances, its auditor cannot ignore you.
- How much the client checksA client that recalculates everything you send relies less on your controls. Few do.
04 · What auditors ask
The questions a client's auditor sends you
If these arrive by email, a SOC 1 is the efficient answer.
- Do you have a SOC 1 Type 2 report, and what period does it cover?
- Which of your services and locations does it cover, and which vendors are carved out?
- Were there exceptions, and how did management respond?
- What controls do you expect our client to operate?
- Has anything significant changed since the period ended?
- If there is no report, can we test your controls ourselves?
The cost of saying no
Without a report, each auditor may need its own procedures at your site. Ten audited clients can mean ten separate visits. One examination is usually the lighter load.
05 · If you are unsure
What to do if you are not sure
Ask, map, then decide. Do not commission a report on a guess.
- Ask the requesting client which of its accounts your service touches, and whether the request came from its auditor.
- List the outputs you send clients that they post, and the controls that make each one reliable.
- Check how many audited clients share the same need. One request may be met another way; several usually are not.
- If the answer is still unclear, have the scope reviewed before engaging a CPA firm, so the objectives match what auditors actually test.
- Offering a SOC 2 instead. It answers security questions, not financial-reporting ones. Some auditors may take parts of it; few will take it whole.
- Scoping every product. Only the services that reach clients' books belong in a SOC 1.
Sources: AICPA SOC 1 page (SOC for Service Organizations: ICFR); AICPA SSAE No. 18, AT-C section 320; AICPA AU-C section 402; Sarbanes-Oxley Act of 2002, section 404 (15 U.S.C. 7262). Service sorting is illustrative and based on our reasoning.
Questions about needing a SOC 1
We are a small provider. Can we be too small to need one?
Size is not the test; your clients' audits are.
A small payroll bureau with listed clients can need a SOC 1 before a large software company does. What matters is whether your output reaches audited financial statements.
Only one client has asked. Is that enough reason?
Maybe not on its own.
One request can sometimes be met by letting the client's auditor perform procedures. If more audited clients share the flow, a report usually becomes the simpler route.
Our clients are in India. Do they still ask for SOC 1?
Some do, especially groups with US-listed parents.
SOC 1 is an AICPA report, so requests tend to come from clients whose auditors work to US standards or to the international equivalent. Ask what form the auditor will accept.
Can a SOC 1 cover only one of our services?
Yes.
The description sets the boundary. Many providers scope only the services that reach clients' books and leave the rest out.
Find out whether your clients' auditors need you.
We trace which of your outputs reach clients' financial statements and tell you whether a SOC 1 is the right answer before you engage a CPA firm.