Definition and purpose

The purpose of a SOC 1 report is to provide assurance to clients and their auditors regarding the controls in place at a service organization that are relevant to financial reporting. The report aims to evaluate the design and operating effectiveness of these controls and assess their effect on the financial statements of the service organization's clients.

Governing Body

SOC 1 is part of a suite of services created and maintained by the American Institute of Certified Public Accountants (AICPA). AICPA provides guidance on how SOC 1 reports should be conducted, what should be included, and the criteria against which the controls are assessed.

Last updated

The SOC 1 framework is subject to periodic updates and revisions by the AICPA to ensure its continued relevance and effectiveness. The last major update to SOC 1 occurred in 2016, with the introduction of the SSAE 18 standard, which replaced SSAE 16.

Applies to

SOC 1 reports are typically relevant for service organizations that impact the financial operations of users. Examples include payroll processing software, billing management platforms, financial reporting software, and trust companies. 

Controls and requirements

A SOC 1 report evaluates the design and operating effectiveness of a service organization’s controls that are likely to be relevant to their client’s internal control over financial reporting (ICFR). These controls vary depending on the services that the organization provides and their control objectives, i.e., what aspects of financial reporting the controls intend to address. Examples of control objectives include the recording of valid transactions, the completeness and accuracy of transactions, and the timeliness of posting transactions.

Please refer to the AICPA website for official resources related to SOC 1 controls and requirements.

Audit type, frequency, and duration

• Audit Type: To obtain a SOC 1 report, organizations must undergo an audit by a CPA, which involves rigorous testing of the organization’s controls that are directly related to user financial operations. There are two types of SOC 1 reports: Type 1 and Type 2. A Type 1 report assesses the design of controls at a specific point in time, while a Type 2 report evaluates the design and  operating effectiveness of controls over a specified period.
• Audit Frequency: The frequency depends on the requirements of the service organization’s clients and auditors. Typically, organizations undergo a SOC 1 annually at least to provide ongoing assurance to clients and stakeholders, but it can be quarterly.
• Audit Duration: The duration of a SOC 1 audit can vary depending on the scope of the audit and the complexity of the service organization's infrastructure and operations. Like a SOC 2®, it typically ranges from a few weeks to a few months.