What is a SOC 1 report?
A SOC 1 report is an independent auditor's report on the controls at a service organisation, such as a payroll provider, payment processor or cloud finance system, that are relevant to its customers' financial reporting. Customers and their auditors use it to rely on those controls instead of testing them directly. It follows the AICPA's SSAE 18 standards.
Also calledSOC 1 Type 2SSAE 18ISAE 3402service organisation controls report
Compare the softwareBest audit software →All 8 audit vendors →
- Standard
- SSAE 18 (ISAE 3402 internationally)
- Type 2 covers
- Operating effectiveness over a period
- Focus
- Controls over financial reporting
How a SOC 1 report works
A Type 1 report covers the design of the service organisation's controls at a point in time; a Type 2 report also tests whether they operated effectively over a period, usually six or twelve months, and is the one auditors normally need. The report describes the system, lists control objectives and the controls that meet them, gives the service auditor's opinion and the test results, and lists complementary user entity controls that the customer must operate itself, such as reviewing access or reconciling outputs. When the report period does not cover the customer's year end, the provider issues a bridge letter. The international equivalent is ISAE 3402. SOC 1 is about financial reporting controls; SOC 2 covers security, availability and privacy. NetSuite and BlackLine provide SOC 1 Type 2 reports to their customers.
Common questions
What is the difference between SOC 1 and SOC 2?+
SOC 1 covers controls relevant to customers' financial reporting and is used by auditors. SOC 2 covers security, availability, processing integrity, confidentiality and privacy, and is used more widely in vendor due diligence.
What is the difference between a SOC 1 Type 1 and Type 2?+
Type 1 assesses whether controls are suitably designed at a point in time. Type 2 also tests whether they operated effectively over a period, usually six to twelve months.
What are complementary user entity controls?+
Controls the service provider assumes its customers will operate, such as managing user access and reviewing reports. If the customer does not operate them, the provider's controls may not be enough.
Finance software with SOC 1 reports
Part of Accountio’s accounting technology coverage · Glossary
