Integrated programme
SOC 1 and SOC 2 together: two reports, one control environment: video
A film on preparing one control environment that supports both a SOC 1 and a SOC 2 examination, for payroll, billing, finance and accounting BPOs and fintech platforms.
Key takeaways
- SOC 1 serves clients' financial statement auditors; SOC 2 serves security reviewers.
- Both are CPA firm attestation reports, not certificates.
- General IT controls serve both; business process controls are added for SOC 1.
- Align both report periods where clients accept it.
- System descriptions must match how the service actually runs.
Two reports for two kinds of reader
Service organisations whose work affects their clients' financial statements, such as payroll, billing, finance and accounting BPOs and fintech platforms, are often asked for a SOC 1 report as well as a SOC 2 report. The two serve different readers. SOC 1 is for clients' financial statement auditors and covers controls relevant to their financial reporting. SOC 2 is for clients assessing a provider's security and related Trust Services Criteria. Many service organisations need both.
Both are attestation reports issued by an independent CPA firm, not certificates. This short film walks through how one control environment is prepared to support both examinations.
Payroll, billing, finance and accounting providers are typical: their clients' financial statement auditors rely on SOC 1, while security reviewers ask for SOC 2.
The difference is the reader: SOC 1 covers controls relevant to clients' financial reporting and is read by their finance teams and external auditors, while SOC 2 covers security and, where chosen, availability, processing integrity, confidentiality and privacy. Management writes the SOC 1 control objectives for the services clients use.
Shared IT controls, added business process controls
General IT controls, such as access, change management and operations, serve both reports and are built once. Business process controls relevant to clients' financial reporting are then added for SOC 1. The same access, change and operations evidence serves both examinations, and both system descriptions are written to match how the service actually runs, so the CPA firm reads one consistent picture.
Where clients accept it, both examinations are planned over the same report period, which avoids two separate evidence cycles each year. A Type 1 or Type 2 report can be chosen for each depending on what clients request and the time available, with Type 2 reports covering how controls operated over a period.
Sterling prepares the controls, the evidence and both system descriptions and supports the organisation through the examinations, with one consultant and one Effivity workspace under an all-inclusive proposal. The CPA firm alone issues the reports.
SOC 1 (ISAE 3402 / SSAE 18) at a glance
- Purpose
- Independent assurance for your clients and their auditors about the controls over the transactions you handle that affect their financial statements
- Relevant to
- Service organisations whose processing reaches clients' financial reporting: payroll, loan servicing, insurance and medical claims, fund administration, finance and accounting outsourcing, and hosted financial systems
- Edition
- AT-C section 320 of the AICPA attestation standards, from SSAE No. 18 and in effect since 1 May 2017; internationally, ISAE 3402, issued by the IAASB in December 2009
- Attestation
- Examined and reported on by a CPA firm acting as service auditor, or by a service auditor reporting under ISAE 3402; Type 1 as at a date, Type 2 over a period
- Sterling's role
- Gap analysis, control objectives and the system description written with your team, Effivity, training, readiness testing and fieldwork support, then Sustain™ through each renewal
- Cost and timing
- Total investment for a SOC 1 control environment depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months to a Type 1 report and 10 to 18 months to a first Type 2 report
SOC 1 (ISAE 3402 / SSAE 18): questions people ask
Is SOC 1 a certification?
No. There is no SOC 1 certificate, no public register and no pass mark. A SOC 1 report contains an independent service auditor's opinion on management's description of your system and on the design of your controls and, in a Type 2, on their operating effectiveness, with the tests performed and their results. Anyone offering to make you "SOC 1 certified" or "SSAE 18 certified" is describing something neither standard provides.
SOC 1 or SOC 2: which report do our clients need?
Ask what they will use it for. SOC 1 covers controls relevant to your clients' financial reporting and is read by their finance teams and external auditors. SOC 2 covers security and, where chosen, availability, processing integrity, confidentiality and privacy, and is read by security and procurement teams. Payroll, claims and fund processors are often asked for both; one control environment can support both.
What is the difference between SSAE 18 and ISAE 3402?
They are two standards for the same kind of report. SSAE 18, through AT-C section 320, is the AICPA standard CPA firms follow in the United States; ISAE 3402 is the IAASB's international equivalent. Which one your report follows depends on what your clients' auditors expect and on the service auditor you appoint, so confirm both before the engagement letter is signed.
Type 1 or Type 2: which report should we get first?
A Type 1 covers management's description and the design of your controls as at a date. A Type 2 adds whether the controls operated effectively throughout a period, which is what a client's auditor needs if it intends to rely on them. If a client is waiting, a Type 1 now with the Type 2 period already running is often sensible; if there is time, going straight to a Type 2 saves an examination.
Who writes the control objectives?
Your management does, for the services your clients use, and the objectives have to address what could go wrong in your processing that would matter to their financial reporting. Clients' auditors may say which areas they expect to see covered. The CPA firm evaluates the description, the objectives and the controls; it does not write them for you. Sterling helps you write them.
Keep exploring
Related to this video
The complete guide
Everything on SOC 1 (ISAE 3402 / SSAE 18)
Start with the SOC 1 (ISAE 3402 / SSAE 18) page · SOC 2, or go straight to the guide you need.
On the SOC 1 (ISAE 3402 / SSAE 18) page
Guides
Often combined with SOC 1 (ISAE 3402 / SSAE 18)
More videos: Integrated programmes
- ISO 9001, ISO 14001 and ISO 45001 together: one QHSE systemIntegrated programme · 3 min 14 s
- ISO 9001 and ISO 45001 together: quality and safety in one systemIntegrated programme · 3 min 14 s
- ISO 9001 and ISO/IEC 27001 together: quality and information security in one systemIntegrated programme · 3 min 14 s
- ISO 9001 and HACCP together: quality management with a food safety plan built inIntegrated programme · 3 min 14 s
- HACCP and GMP together: the prerequisites and the plan, built as oneIntegrated programme · 3 min 14 s
- ISO/IEC 27001 and PCI DSS together: one control set, two outcomesIntegrated programme · 3 min 24 s
- ISO/IEC 27001 and SOC 2 together: one control set for every marketIntegrated programme · 3 min 24 s
- ISO/IEC 27001, PCI DSS and SOC 2 together: one control set, three outcomesIntegrated programme · 3 min 24 s
- ISO/IEC 27001 and HIPAA together: a certified security system around the US health data lawIntegrated programme · 3 min 14 s
Talk to a consultant
Plan your SOC 1 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice