SOC 1 — System and Organization Controls for Financial Reporting

Why does it matter?

A SOC 1 report is how a service organization answers its customers' auditors once instead of hundreds of times. Without it, each user auditor must obtain evidence about the controls at the service organization that prevent, or detect and correct, errors in the information it provides, which the AICPA's own guidance describes as controls that are relevant to the user entity's internal control over financial reporting even though they operate outside the user entity. Since the SSAE No. 16 change, the service auditor's opinion on the description and on the design of controls in a type 2 report covers the whole period, not an as-of date, so a lapse in a control during the year appears as an exception in the report that every user auditor will read.

Key benefits include:

• Written for user auditors

AT-C section 320 produces a report that user entities and their auditors use when evaluating the effect of the service organization's controls on the user entities' financial statements.

• Control objectives set by the service organization

The service organization writes the control objectives for its processing and IT general controls; the auditor evaluates whether they are reasonable and whether the controls achieve them.

• Management's assertion

Since SSAE No. 16 the service auditor must obtain a written assertion from management about the fairness of the description and the design and operation of controls.

• Type 1 and type 2

A type 1 report covers the description and the suitability of control design as of a date; a type 2 report adds tests of operating effectiveness over a period and the results of those tests.

• Subservice organizations handled explicitly

The description presents a subservice organization either by the inclusive method or by the carve-out method, and the AICPA guide gives the reporting for each.

How does it work?

AT-C section 320 is the subject-matter section of the attestation standards for reporting on an examination of controls at a service organization relevant to user entities' ICFR. An engagement applies three AT-C sections together: AT-C 105, the concepts common to all attestation engagements; AT-C 205, the requirements for an examination; and AT-C 320, the incremental requirements for this subject matter. The service auditor plans the engagement, obtains management's written assertion, evaluates the description of the service organization's system, including the services provided, the processes and the key system outputs, and judges whether the control objectives are reasonable in the circumstances.

The service organization's description covers the system that provides the services, the control objectives and the controls designed to achieve them, and, where the organization uses a subservice organization, either includes that organization's controls (inclusive method) or carves them out and identifies the controls the subservice organization is expected to apply (carve-out method). In a type 2 engagement the auditor tests the operating effectiveness of the controls throughout the period, which the AICPA's 2025 guide illustrates with example procedures, and reports any deviations.

The service auditor's report contains the opinion on the fairness of the description, the suitability of the design of the controls and, for type 2, their operating effectiveness over the period, together with the description of tests and results. The guide includes illustrative paragraphs for a qualified or disclaimed opinion, for the omission of key system outputs and for inclusive and carve-out presentations. User auditors then use the report under the auditing standard for entities that use a service organization, which the AICPA created at the same time as SSAE No. 16, to obtain the understanding and evidence they need for their own audit.

Key Elements

• System description

Services provided, processes, people, data and key system outputs, presented fairly so that user auditors can understand what the controls cover.

• Control objectives and controls

Objectives for transaction processing and IT general controls, written by the service organization, each supported by the controls that achieve it.

• Management's written assertion

Management's statement about the fairness of the description and the suitability of design, and for type 2 the operating effectiveness, of the controls.

• Type 1 or type 2 opinion

An opinion as of a date on description and design, or over a period on description, design and operating effectiveness with the tests and results described.

• Subservice organizations

Inclusive or carve-out presentation of any organization that performs part of the service, with the controls expected at the subservice organization identified.

• Qualified or disclaimed opinions

The guide supplies the paragraphs the service auditor adds when qualifying or disclaiming an opinion, or when a description of key system outputs is omitted, so exceptions reach user auditors in a standard form.

What does it cover?

SOC 1 applies to a service organization whose services are part of its customers' information systems relevant to financial reporting: transaction processing, record keeping, custody, payroll, benefits and claims administration, fund accounting and the hosting or operation of software that produces financial information. The AICPA's SOC 1 subtopic states that these reports are specifically intended to meet the needs of user entities and the CPAs that audit their financial statements. Controls relevant to security, availability, processing integrity, confidentiality or privacy that do not bear on user entities' financial reporting are outside SOC 1 and belong in a SOC 2 or SOC 3 engagement.

What are its objectives?

The engagement exists to give user entities and user auditors an independent opinion on the controls at a service organization that affect their financial statements. In practice it aims to:

Describe the service organization's system and control objectives fairly so that user auditors can map them to their own audit risks.

Provide an opinion on whether the controls were suitably designed and, in a type 2 report, operated effectively throughout the period.

Report every deviation found in testing so that user auditors can evaluate its effect.

Present any subservice organization by the inclusive or carve-out method so that no part of the service is assumed covered when it is not.

Replace repeated auditor inquiries with one report issued under a common standard.

Framework in Context

SOC 1 is the ICFR member of the AICPA's SOC suite; SOC 2 reports on controls relevant to security, availability, processing integrity, confidentiality or privacy against the Trust Services Criteria, and SOC 3 is the general-use version of that report. SSAE No. 16 was based on the International Auditing and Assurance Standards Board's ISAE 3402, so a SOC 1 report and an ISAE 3402 report serve the same purpose for user auditors in the United States and elsewhere. For a service organization whose customers are SEC registrants, the report is evidence the customers use in their own assessment of internal control over financial reporting under the Sarbanes-Oxley Act, which is why SOC 1 control objectives are usually written in the language of ICFR components rather than security categories.

Common Framework Mappings

Organizations map SOC 1 control objectives to the frameworks below so that the same controls and evidence serve user auditors, SOX programs and IT governance reviews.

Mapped frameworks include:

COBIT 2019

COSO IC 2013

ISO 27001:2022

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2

SOC 3

SSAE No. 18