SOC 1: Guide to Financial Reporting Controls
SOC 1 reports, governed by SSAE 18 (Statement on Standards for Attestation Engagements No. 18), examine the internal controls at a service organization that are relevant to their client's financial reporting. If your service affects your customers' financial statements, SOC 1 is likely the right report.
What SOC 1 Covers
Unlike SOC 2 which focuses on security, availability, and processing integrity broadly, SOC 1 is specifically concerned with controls that could impact a user entity's financial reporting. This includes transaction processing controls, data integrity safeguards, IT general controls, logical access restrictions, and change management for systems that process financial data.
The scope is tailored to each organization — you define the services, systems, and controls relevant to your customers' financial reporting, and the auditor tests those controls.
Type I vs. Type II
- Type I — Evaluates the design of controls at a specific point in time. Useful as a first step or when time is limited.
- Type II — Evaluates both the design and operating effectiveness of controls over a period (typically 6 to 12 months). This is what most customers require.
Who Needs SOC 1
SOC 1 is essential for service organizations whose activities impact client financial reporting. Common examples include payroll processors, payment processors, loan servicing companies, claims administrators, data center hosting providers for financial applications, and SaaS companies that process financial transactions.
If your customers' auditors ask about your controls over financial reporting, you need a SOC 1 report. If their questions center on data security and availability more broadly, SOC 2 may be more appropriate.
Audit Process
- Scope definition — Identify services and controls relevant to client financial reporting
- Readiness assessment — Evaluate current control design and effectiveness
- Remediation — Address gaps identified during readiness
- Observation period — For Type II, operate controls for 6-12 months
- CPA audit — Independent CPA firm tests controls and issues the report
- Report delivery — Share the report with customers under NDA
Cost Drivers
The largest cost components are CPA firm audit fees and internal staff time. Organizations with complex processing environments, multiple service lines, or numerous ITGC controls should expect costs toward the higher end of the range.