Definition
SOC stands for System and Organization Controls, a family of AICPA attestation reports. A SOC 1 report addresses controls at a service organization likely to be relevant to user entities' internal control over financial reporting, under AT-C 320. SOC 2 reports address controls relevant to security, availability, processing integrity, confidentiality, or privacy. SOC 3 covers the same criteria in a general-use report. A Type 1 report covers design at a date. A Type 2 report also covers operating effectiveness over a period.
Why it matters in an audit or review
User auditors read a SOC 1 Type 2 report to decide whether controls at a payroll processor, custodian, or hosting provider reduce the need for their own testing under AU-C 402. They check the period covered, the control objectives, exceptions noted, the complementary user entity controls, and whether subservice organizations are carved out.
Example
Illustrative: a client outsources payroll processing. The auditor obtains the provider's SOC 1 Type 2 report, notes that it covers January through September, and plans additional procedures for the gap period and for the client's own user controls.
Common mistakes
Reading only the opinion paragraph. Exceptions in the test results and unaddressed user entity controls often matter more than the opinion.
FAQ
What is the difference between SOC 1 and SOC 2?
SOC 1 focuses on financial reporting controls. SOC 2 focuses on trust services criteria such as security and availability.
Sources
- AICPA, AT-C Sections 105, 205 and 320
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
- AICPA, SOC for Service Organizations suite of guides (SOC 1, SOC 2, SOC 3)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error