Definition
A SOC 1 report is a report by a service auditor under AT-C 320 (SSAE 18) on controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting. It includes management's description of the system, management's assertion, and the service auditor's opinion on the description and the controls.
Why it matters in an audit or review
A user entity's auditor reads the report under AU-C 402 to get an understanding of the services and to decide whether it provides evidence about controls. A Type 2 report that covers the right period, the right services and the controls relevant to the user's risks can serve as evidence of operating effectiveness. The user auditor must still evaluate the service auditor's competence, the report period and any exceptions, and consider user controls.
Example
A company outsources payroll processing. The auditor obtains the provider's Type 2 SOC 1 for October 1 to September 30, reads the control objectives over payroll calculation and the test results, and notes two exceptions in the tax-rate update control. The auditor checks the company's own payroll register review for compensating effect and covers the gap from October to December with a bridge letter.
Common mistakes
Treating a SOC 2 report as a substitute. SOC 2 addresses security, availability and similar criteria, not controls over financial reporting.
Sources
- AICPA, AT-C Section 320 (SSAE No. 18)
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
- AICPA, Guide: Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error