Implementation walkthrough
How to prepare for a SOC 1 report (SSAE 18 / ISAE 3402): video walkthrough
A walkthrough of preparing a service organisation for a SOC 1 examination of the controls that affect its clients' financial reporting.
Key takeaways
- SOC 1 covers controls relevant to clients' financial reporting.
- It is an attestation by a CPA firm acting as service auditor, not a certification.
- You define the control objectives; the standard does not list controls.
- The system description sets out how transactions flow and who is responsible.
- Choose SSAE 18 or ISAE 3402, and Type 1 or Type 2, to suit your clients and their auditors.
Assurance for clients' financial statement auditors
SOC 1 is an examination of the controls at a service organisation that are likely to be relevant to its clients' internal control over financial reporting. When the payroll a provider runs, the claims it adjudicates, the loans it services or the ledgers it hosts flow into a client's financial statements, the client and its external auditor need to know whether those controls can be relied on. A SOC 1 report answers that question once for all of them: a CPA firm acting as service auditor examines the controls and reports its opinion. Outside the United States the equivalent report is issued under ISAE 3402.
SOC 1 is an attestation, not a certification, and it does not hand the organisation a list of controls. This short film walks through how a provider prepares for the examination.
From control objectives to the service auditor's opinion
First define the services, the clients and the report: which services affect clients' financial reporting, which clients and auditors will read the report, whether SSAE 18 or ISAE 3402 applies, whether a Type 1 at a date or a Type 2 over a period is needed, and a period that covers as much of the clients' financial years as possible. A gap analysis then compares current controls with what the report will need.
For each service, the organisation defines the control objectives that matter to clients' financial reporting, operates controls that achieve them, states the responsibilities that sit with clients and subservice providers, and describes how transactions are initiated, authorised, recorded, processed, corrected and reported. That description, with process descriptions and flowcharts, is what the service auditor examines. Readiness testing checks the controls before the period begins, so exceptions are fixed rather than reported, and the CPA firm then performs its fieldwork and issues its report. The opinion belongs to the service auditor, and its independence is why clients' auditors can use it.
Sterling's expert and experienced consultants write the control objectives and system description with your team and support you through fieldwork under Sterling OS™, with the evidence held in Effivity.
SOC 1 (ISAE 3402 / SSAE 18) at a glance
- Purpose
- Independent assurance for your clients and their auditors about the controls over the transactions you handle that affect their financial statements
- Relevant to
- Service organisations whose processing reaches clients' financial reporting: payroll, loan servicing, insurance and medical claims, fund administration, finance and accounting outsourcing, and hosted financial systems
- Edition
- AT-C section 320 of the AICPA attestation standards, from SSAE No. 18 and in effect since 1 May 2017; internationally, ISAE 3402, issued by the IAASB in December 2009
- Attestation
- Examined and reported on by a CPA firm acting as service auditor, or by a service auditor reporting under ISAE 3402; Type 1 as at a date, Type 2 over a period
- Sterling's role
- Gap analysis, control objectives and the system description written with your team, Effivity, training, readiness testing and fieldwork support, then Sustain™ through each renewal
- Cost and timing
- Total investment for a SOC 1 control environment depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months to a Type 1 report and 10 to 18 months to a first Type 2 report
SOC 1 (ISAE 3402 / SSAE 18): questions people ask
Is SOC 1 a certification?
No. There is no SOC 1 certificate, no public register and no pass mark. A SOC 1 report contains an independent service auditor's opinion on management's description of your system and on the design of your controls and, in a Type 2, on their operating effectiveness, with the tests performed and their results. Anyone offering to make you "SOC 1 certified" or "SSAE 18 certified" is describing something neither standard provides.
SOC 1 or SOC 2: which report do our clients need?
Ask what they will use it for. SOC 1 covers controls relevant to your clients' financial reporting and is read by their finance teams and external auditors. SOC 2 covers security and, where chosen, availability, processing integrity, confidentiality and privacy, and is read by security and procurement teams. Payroll, claims and fund processors are often asked for both; one control environment can support both.
What is the difference between SSAE 18 and ISAE 3402?
They are two standards for the same kind of report. SSAE 18, through AT-C section 320, is the AICPA standard CPA firms follow in the United States; ISAE 3402 is the IAASB's international equivalent. Which one your report follows depends on what your clients' auditors expect and on the service auditor you appoint, so confirm both before the engagement letter is signed.
Type 1 or Type 2: which report should we get first?
A Type 1 covers management's description and the design of your controls as at a date. A Type 2 adds whether the controls operated effectively throughout a period, which is what a client's auditor needs if it intends to rely on them. If a client is waiting, a Type 1 now with the Type 2 period already running is often sensible; if there is time, going straight to a Type 2 saves an examination.
Who writes the control objectives?
Your management does, for the services your clients use, and the objectives have to address what could go wrong in your processing that would matter to their financial reporting. Clients' auditors may say which areas they expect to see covered. The CPA firm evaluates the description, the objectives and the controls; it does not write them for you. Sterling helps you write them.
Keep exploring
Related to this video
Read next
Services
The complete guide
Everything on SOC 1 (ISAE 3402 / SSAE 18)
Start with the SOC 1 (ISAE 3402 / SSAE 18) page, or go straight to the guide you need.
On the SOC 1 (ISAE 3402 / SSAE 18) page
Guides
Often combined with SOC 1 (ISAE 3402 / SSAE 18)
More videos: Financial services, payments and AML
Talk to a consultant
Plan your SOC 1 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice