A SOC 1 report is an independent examination of a service organization’s internal controls over financial reporting, performed by a licensed CPA firm under standards set by the American Institute of Certified Public Accountants.1AICPA & CIMA. SOC 1 – SOC for Service Organizations: ICFR Its purpose is narrow and specific: to give the provider’s clients, and the auditors of those clients, reasoned confidence that outsourced work touching the client’s books is handled with adequate safeguards. If your company relies on a payroll processor, a claims administrator, a loan servicer, or hosted accounting software, expect SOC 1 reports to come up during your annual financial audit.
What the Report Actually Evaluates
SOC 1 focuses on Internal Controls over Financial Reporting, abbreviated ICFR. The audit examines the policies, procedures, and technical safeguards a service organization uses to keep client financial data accurate and protected from unauthorized change.1AICPA & CIMA. SOC 1 – SOC for Service Organizations: ICFR When a third-party payroll company calculates wages, withholds taxes, and issues checks, a SOC 1 asks whether the controls around those activities are strong enough that the client can rely on the numbers flowing into its own financial statements.
The scope is deliberately limited. A SOC 1 does not evaluate the provider’s entire IT environment, its privacy program, or its disaster recovery capabilities unless those controls directly affect client financial reporting. That tight focus is what makes the report useful to financial auditors. It answers a specific question about whether outsourced processing could introduce errors or fraud into the client’s books.
Type 1 and Type 2 Reports
Every SOC 1 comes in one of two forms, and the difference is substantial.
A Type 1 report evaluates whether controls are designed properly as of a single date. The auditor picks a specific day, reviews the policies and procedures in place at that moment, and issues an opinion on whether the design is sound. It is a snapshot. It tells you what things looked like on December 31, not whether anyone followed through the rest of the year.
A Type 2 report tests whether those controls actually operated over a defined period. Most Type 2 examinations cover twelve months, though there is no required minimum period length. During that window the auditor pulls samples, examines logs, interviews staff, and documents whether the controls performed consistently. A Type 1 confirms a policy exists. A Type 2 proves people followed it. Financial auditors strongly prefer Type 2 reports for that reason.
Organizations new to SOC reporting often start with a Type 1 to establish a baseline. That lets management identify and fix design weaknesses before committing to the longer examination window of a Type 2. Once the Type 1 is complete, the organization moves to annual Type 2 engagements. Skipping straight to a Type 2 is possible but risky if the control environment has not been documented and tested internally.
What’s Inside the Report
A completed SOC 1 contains several distinct sections that together give the reader a full picture of the control environment.
- Independent service auditor’s report. The CPA firm’s formal opinion on whether the system description is fairly presented and the controls are suitably designed. For a Type 2, the opinion also addresses whether the controls operated effectively during the examination period.
- Management’s assertion. A written statement from the service organization’s leadership confirming that the system description is accurate, the controls are appropriately designed, and, for Type 2, operated effectively during the period.2PCAOB. AS 2601: Consideration of an Entity’s Use of a Service Organization
- Description of the system. A narrative explaining the services provided, the infrastructure and software involved, the people and processes that deliver the service, and the boundaries of what the report covers.
- Control objectives and related controls. A list of specific goals, such as ensuring wire transfers above a certain dollar amount require dual authorization, paired with the controls designed to achieve each objective.
- Tests of controls and results (Type 2 only). A detailed table showing exactly what the auditor tested, how the testing was performed, and the results. This is the section financial auditors scrutinize most carefully, because it reveals whether any controls failed during the period.
Almost every SOC 1 also lists Complementary User Entity Controls, sometimes called CUECs. These are controls the client must perform because the service organization cannot. A payroll processor may require clients to notify it promptly when an employee is terminated so access gets revoked on time. A cloud accounting platform may require clients to enforce strong password policies on their end. If the client ignores these responsibilities, the provider’s controls alone will not fully protect the financial data.
How to Read the Auditor’s Opinion
The opinion is the first thing most readers turn to, and it falls into one of four categories.
- Unqualified (clean). The controls are fairly described, suitably designed, and, for Type 2, operated effectively. No material issues found.
- Qualified. The controls are mostly sound, but the auditor identified one or more material issues that are not severe enough to undermine the entire report. The opinion spells out the exceptions.
- Adverse. The auditor found issues so significant and widespread that the controls cannot be relied on. A serious red flag for any client relying on the provider.
- Disclaimer. The auditor could not gather enough evidence to form an opinion at all. This usually signals a breakdown in cooperation between the service organization and the auditor.
An unqualified opinion does not mean zero findings. The tests-of-controls section in a Type 2 may still show individual control failures, called exceptions, that were not material enough to change the overall opinion. Careful user auditors read past the opinion letter and examine the exceptions, because a pattern of minor failures can point to deeper operational problems.
SOC 1 and SOC 2 Are Not the Same Report
SOC 1 and SOC 2 are frequently confused because both involve an independent audit of a service provider, but they examine different things. A SOC 1 looks at controls relevant to financial reporting. A SOC 2 evaluates controls against the AICPA’s Trust Services Criteria, which cover security, availability, processing integrity, confidentiality, and privacy. Security is always included in a SOC 2; the other four categories are optional depending on the engagement.
The practical difference is audience. A company’s financial auditor needs a SOC 1 to complete the annual audit of the financial statements. A SOC 2 is what a prospective customer or a vendor management team reviews when evaluating whether a provider’s broader security and operational controls meet industry standards. Many service organizations produce both.
Who Can Receive the Report
SOC 1 reports are restricted-use documents. They can be shared only with the service organization’s management, its clients (called user entities), and those clients’ external auditors (called user auditors). Unlike a SOC 3, which is designed for general public distribution, a SOC 1 cannot be posted on a website or handed to a prospective customer who has not signed an agreement.
User entities need the report to understand how the provider’s controls affect their own financial reporting risks. Without it, the client’s external auditor would have to either send a team to the provider’s facility to test controls directly, which is expensive and often logistically impossible, or treat the outsourced process as a black box, which means compensating with far more testing on the client’s side. A clean report can reduce audit costs for the client. A problematic one drives them up.
SSAE 18 and Subservice Organizations
SOC 1 examinations are performed under the Statement on Standards for Attestation Engagements, currently governed by SSAE 18, which took effect on May 1, 2017, and replaced the earlier SSAE 16 framework. The standard is codified as AT-C Section 320 in the AICPA’s professional standards. One of the most consequential changes SSAE 18 introduced was stricter treatment of subservice organizations, the vendors a service provider relies on to deliver its own services.
If a payroll company stores its data in a third-party cloud hosting facility, that hosting provider is a subservice organization. SSAE 18 requires the payroll company to actively monitor and oversee that relationship rather than assume the hosting provider has adequate controls. The standard offers two methods for addressing subservice organizations in the report.
- Carve-out method. The report describes what the subservice organization does but excludes its control objectives and specific controls from the audit scope. The service organization must instead describe its own monitoring controls over the subservice provider. This is the more common approach.
- Inclusive method. The subservice organization’s controls are included directly in the service organization’s report and tested by the auditor alongside everything else. This requires the subservice organization’s cooperation and is used less frequently.
Under the carve-out method, the user entity’s auditor will not see the subservice organization’s controls tested in the SOC 1. If that gap matters, the user auditor can request the subservice organization’s own SOC report separately. This layering is common in industries with complex outsourcing chains. A benefits administrator might rely on a claims processor that relies on a data center, each with its own SOC 1.
Bridge Letters and Annual Renewal
A practical timing problem comes up constantly. Most Type 2 reports cover a period ending September 30 or some other date that does not align with the client’s December 31 fiscal year-end. That leaves a gap. The client’s auditor needs assurance covering the full year, and the SOC 1 stops short by a few months.
A bridge letter, sometimes called a gap letter, addresses this. The service organization issues a written statement covering the interval between the end of the SOC 1 period and the client’s year-end, confirming that no material changes to controls occurred during that window. Bridge letters work best when the gap is three months or less. If the timing mismatch is longer, it is usually better for the service organization to shift its examination period to better align with client needs than to stretch a bridge letter’s credibility.
Type 2 reports should be renewed annually. Letting a report lapse puts clients in a difficult position, because their auditors will either demand a current report or increase testing to compensate. Organizations that treat a SOC 1 as a one-time project rather than an ongoing compliance cycle tend to find, at renewal, that the control environment has drifted from what was originally documented.