Framework Assurance Reports
SOC 1 is the AICPA's report on controls at a service organization that are relevant to its customers' internal control over financial reporting. It is performed under the attestation standards (SSAE No. 18, AT-C section 320) and is meant for two audiences: the customer organizations that outsource a process, and the CPA firms that audit those customers' financial statements.
Payroll, claims processing, fund accounting, transaction processing and hosting of financial systems are the usual subjects.
To get one, the service organization must write a description of its system, define control objectives, map the controls that achieve them, and sign a management assertion. A Type 1 report covers design at a point in time; a Type 2 report also covers operating effectiveness across a period.
Because the auditor tests exactly what is described, the written procedures, approval chains and control owners have to be current and evidenced.
Voluntary and contractual. Any service organization whose service affects a customer's financial statements will be asked for it by customers or by the customer's financial statement auditor, especially where the customer is publicly traded or regulated.
System description and management assertion; control objectives and control matrix; organization chart with control owners; policies and procedures for the in-scope processes; population lists (transactions, changes, access grants, terminations); sampled evidence per control (approvals, reconciliations, tickets, logs, access reviews); subservice organization SOC reports and complementary user entity controls; management review and exception handling records.
Assessors
A licensed CPA firm (a firm of independent certified public accountants) that performs the examination and issues the service auditor's report. Accredited by AICPA membership and state board CPA licensure; firms performing attestation engagements are subject to the AICPA peer review program. No separate scheme accreditor.
No firm has claimed a SOC 1 assessor listing yet. Claim yours →
Consultants
Yes. Readiness consultants (advisory firms, the consulting arms of CPA firms, GRC platform vendors) help write the system description, set control objectives, build the control matrix, and rehearse evidence collection. Typical engagement is a readiness assessment, remediation, then the examination, with the readiness firm kept independent from the signing firm.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Not sure where to start?
Tell us what you are trying to put in place. We will point you to the right tool, a consultant who can implement it, or both.