What it is
A SOC 1 report addresses controls at a service organization that are relevant to its customers’ internal control over financial reporting. It is performed under AT-C 320 and used by customers’ auditors under AU-C 402. This checklist covers scope, control objectives and controls, IT general controls, user entity controls, the description and assertion and the evidence the service auditor will need.
It is a planning tool. Completing it does not mean an organization will receive a SOC 1 report, and a SOC 1 report is an attestation, not a certification.
When to use it
- Deciding whether to commission a SOC 1 report for a service that affects customers’ financial reporting.
- Preparing control objectives and the system description.
- Tracking gaps before the examination period.
What’s inside
- Scope: services, report type, period and subservice organizations
- Control objectives and controls, including information produced for customers
- Access, change and operations controls
- Complementary user entity controls and subservice organization monitoring
- Description, assertion and evidence readiness
Standard cited
This template follows AT-C 320 / AU-C 402. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
When is SOC 1 the right report?
When the service organization’s controls are part of its customers’ internal control over financial reporting, for example payroll processing, transaction processing or record keeping. If customers care about security, availability or privacy instead, SOC 2 may fit better.
What are complementary user entity controls?
Controls the customers must operate for the service organization’s control objectives to be met. They are described in the report so user auditors can consider them.
Carve-out or inclusive method?
Under the carve-out method the description excludes the subservice organization’s controls. Under the inclusive method it includes them, and the subservice organization takes part in the examination. Decide before the period starts.
Related templates
- SOC 2 Readiness Checklist (Trust Services Criteria)
- ITGC Testing Matrix: Access, Change and Operations
- IPE Testing Worksheet (Information Produced by the Entity)
Last updated 11/05/2026. All free templates.