SOC 1

What SOC 1 is

SOC 1 is an attestation report produced by an independent CPA firm on the controls at a service organization that are relevant to its customers’ internal control over financial reporting. It is performed under the AICPA attestation standard SSAE 18, and the output is an opinion, not a certificate.

It exists because a customer’s financial statements often depend on work done outside the customer’s own walls. When a company outsources payroll, transaction processing, claims handling, or fund administration, its own auditors need assurance that the outsourced process is controlled. A SOC 1 report gives them that assurance without each of them auditing the provider separately.

Who asks for one

The request usually comes from a customer’s finance team or its external auditors, not from a security reviewer. Common examples include providers of:

• –Payroll and benefits administration
• –Payment and transaction processing
• –Loan, claims, or policy servicing
• –Fund administration and investment operations
• –Billing, revenue, or accounting software that feeds a customer’s general ledger

Type I and Type II

As with SOC 2, the two report types answer different questions.

• –A Type I report covers whether controls are suitably designed as of a single date.
• –A Type II report covers whether those controls operated effectively across a period, typically six to twelve months, and requires evidence from throughout that window.
• –Customer auditors generally rely on a Type II, because their own audit covers a full financial year.

SOC 1 and SOC 2

SOC 2 covers security and how a company protects customer data, examined against the Trust Services Criteria. SOC 1 covers controls that affect a customer’s financial reporting, examined against control objectives the service organization defines for its own process.

Some organizations need both. A payroll provider, for example, may be asked for SOC 1 by a customer’s auditors and for SOC 2 by the same customer’s security team. The readiness work overlaps, but the reports are separate and are read by different people.

What an engagement involves

• –Defining the system description and the processes in scope
• –Writing control objectives that match what customers rely on
• –Mapping the controls that achieve each objective, including the IT general controls behind them
• –Identifying complementary user entity controls, the controls the customer is expected to operate on its side
• –Producing evidence through the observation period for a Type II
• –Managing the auditor’s sample requests and responding to exceptions as they are raised

How Verdict helps

Verdict runs the readiness work, drafts the system description and control objectives, and keeps the evidence record accumulating through the observation period so the audit is a review rather than a scramble. The client reviews all of it in a portal.

Verdict is not the auditor. The opinion has to come from an independent CPA firm, and the CPA audit fee is paid directly to that firm. Pricing is published: SOC 1 readiness starts at $7,000 for a Type I.