If your company is going through a financial statement audit, your auditor will ask for ADP’s SOC 1 report, a confidential document describing the controls ADP uses to process payroll, benefits, and other financial transactions on your behalf. You get it by requesting it through ADP’s client service channels, not from any public page. Request the Type 2 version, confirm the reporting period lines up with your fiscal year, and start the process at least two months before fieldwork so your auditor has time to review it and so you have time to pull together the evidence they will ask for on your end.
Request the Type 2 Report, Not the Type 1
SOC 1 reports come in two versions, and asking for the wrong one costs real time. For an annual financial statement audit, your auditor needs the Type 2.
A Type 1 report is a snapshot. It evaluates whether ADP’s controls were properly designed as of a single date, confirming the right controls exist on paper. It says nothing about whether those controls actually worked over any stretch of time, so your auditor cannot use it to reduce their own testing.
A Type 2 report covers a defined period, typically twelve months. ADP’s independent auditor selects samples of transactions across that period, tests them against the stated control objectives, and documents the results, including any deviations and management’s response. This is the evidence your auditor needs to rely on ADP’s controls and scale back their own transaction-level testing.
Match the report period to your fiscal year as closely as you can. If your year-end is December 31 and the report covers January through September, you have a three-month gap your auditor has to address through other procedures. The closer the alignment, the less additional work gets billed to you.
One boundary worth knowing: SOC 1 covers only controls that could affect your financial statements. If you need assurance about data security, availability, or privacy more broadly, that is a SOC 2 report, which is a different document. Most ADP clients in a financial statement audit need the SOC 1.
How to Get the Report From ADP
The report is confidential and restricted to ADP clients and their auditors. It is not on ADP’s public website and will not surface in a search engine. ADP controls distribution through its own channels.
The standard route is ADP’s client service portal, where compliance documents are available to authorized users. If you cannot locate it there, contact your ADP account representative or the compliance support team directly. When you request the report, specify the SOC 1 Type 2 and state the reporting period your auditor requires. ADP will verify your client status before releasing the document.1ADP. Data Security
Start early. Allow several weeks before fieldwork begins. If verification takes time, or if the most recent report has not yet been issued, a late start translates directly into audit delays. When auditors cannot review the SOC 1 during their planned window, they expand their own substantive testing, and that expanded scope shows up on your invoice.
Bridge Letters for the Gap
ADP issues SOC 1 Type 2 reports on select products and services, typically on an annual cycle, and the report period will not always align with your fiscal year-end. To cover the stretch between the end of the report period and the date your auditor needs assurance through, ADP produces four bridge letters per year, each covering one calendar quarter.1ADP. Data Security
A bridge letter is a management-signed statement from ADP asserting that no significant changes have occurred to the control environment since the last formal report. It fills a gap; it does not replace a Type 2 report. Auditors are generally comfortable relying on bridge letters covering no more than about three months. Beyond that, assurance erodes and your auditor may require additional procedures. Ask about bridge letter availability at the same time you request the report.
What Your Auditor Looks For in the Report
The SOC 1 Type 2 report follows a standard structure. Your auditor will spend the most time on three sections: the service auditor’s opinion, the testing results, and the complementary user entity controls.
The opinion comes first. An unqualified opinion means ADP’s auditor concluded that the system description was fairly presented and the controls operated effectively throughout the report period. That gives your auditor the strongest basis to rely on the report. A qualified opinion flags specific control objectives where the service auditor identified problems; your auditor will check whether those areas touch your transactions and may test around them while still relying on the rest. Adverse opinions and disclaimers are rare for a service organization of ADP’s size, but they essentially eliminate reliance and expand your audit substantially.
Even under an unqualified opinion, the testing results section often lists individual deviations where a specific control did not work as expected. Your auditor weighs the nature and frequency: isolated deviations in areas unrelated to your transactions are typically not a concern, while recurring deviations in payroll processing or benefits calculations will prompt a closer look. ADP’s documented response to each deviation matters too. A finding paired with a credible remediation plan carries less weight than one left unaddressed.
The other sections, including management’s assertion, the system description narrative, and the detailed control objectives, give your auditor the context to interpret the opinion and the testing results.
The Controls You Have to Perform on Your End
Complementary User Entity Controls, or CUECs, are where most companies stumble. ADP’s controls are designed assuming your company performs certain procedures internally. If you are not performing them, ADP’s controls alone are not enough, and your auditor cannot fully rely on the report no matter how clean the opinion.2AICPA & CIMA. SOC 1 – SOC for Service Organizations: ICFR
Common CUECs for payroll services include:
- Reviewing and approving payroll registers before ADP processes the final run
- Reconciling ADP-generated reports to your general ledger
- Restricting access to the ADP portal to authorized personnel
- Promptly notifying ADP of employee terminations and pay rate changes
These are not suggestions. ADP has identified them as necessary for the overall system to work as described. Your auditor will test them directly and ask for evidence that your team performed each one throughout the year. If you cannot produce the evidence, your auditor loses the ability to rely on the corresponding ADP controls, and testing scope expands.
Review the CUEC list from last year’s report as soon as it is available. Assign each control to a specific person, build it into recurring processes, and retain documentation as you go. Discovering a gap during fieldwork is expensive.
Subservice Organizations and Carve-Outs
ADP relies on other vendors to deliver parts of its service, and the report treats them in one of two ways. Under the inclusive method, the subservice organization’s controls are tested alongside ADP’s own. Under the carve-out method, those controls are excluded from the report entirely; the report names the subservice organization and describes what it does, but the service auditor does not test it.3PCAOB. AI 18: Consideration of an Entity’s Use of a Service Organization: Auditing Interpretations of AS 2601
ADP typically uses the carve-out method. When your auditor sees this, they will decide whether the carved-out subservice organization is relevant to your financial reporting. If it is, they may need the subservice organization’s own SOC 1, perform direct testing, or ask you to put compensating controls in place. The report may also list Complementary Subservice Organization Controls, which are the counterpart to CUECs for the downstream vendor. Your auditor handles that analysis, but expect questions.
Mistakes That Cost Time and Money
The most frequent problem is timing. Companies request the report too late, discover it does not cover the right period, and scramble for a bridge letter that may or may not satisfy their auditor. Request the report at least two months before fieldwork, and confirm the reporting period aligns with your fiscal year-end before your auditor arrives.
The second is ignoring CUECs. The report lists them clearly, but many companies never assign ownership internally. When the auditor asks for evidence that someone reviewed the payroll register before every pay cycle, the answer is often a blank stare. Assign each CUEC, document the work as it happens, and keep the records with the rest of your audit support.
The third is treating the report as a checkbox and filing it unread. It contains real information about how ADP handles your financial data. If ADP’s auditor identified deviations in payroll calculation controls and you run payroll for thousands of employees, that finding matters to you operationally, not just to your auditor. Read the report when it arrives, and flag anything that touches the ADP services you actually use.