Two-minute brief
SOC 1 (SSAE 18 / ISAE 3402) explained: video brief
A two-minute brief on the elements a SOC 1 report is built from, under AT-C section 320 or ISAE 3402.
Key takeaways
- SOC 1 has no fixed control list; the organisation defines its control objectives.
- The system description explains how transactions flow through the service.
- Complementary client controls and subservice providers are part of the picture.
- Type 1 reports at a date; Type 2 covers operation over a period.
- SSAE 18 applies in the United States; ISAE 3402 internationally.
The elements of a SOC 1 report
SOC 1 does not give a list of controls or criteria. For each service clients rely on, the service organisation defines the control objectives that matter to their financial reporting, operates controls that achieve them, states the responsibilities that sit with clients and subservice providers, and presents it all in a description a service auditor can examine. This short film walks through those elements.
Scope identifies the services, the kinds of transactions processed and the clients whose financial reporting they affect, typically in a scope statement naming the service lines, systems, locations and client groups covered, and what is left out. Processing describes how transactions are initiated, authorised, recorded, processed, corrected and reported, whether by people or by systems, through process descriptions and flowcharts for each flow. Control objectives and the controls that achieve them, including general IT controls over the systems that process the transactions, form the core of what is tested.
Responsibilities, report types and standards
The report also sets out what the service organisation relies on others to do: complementary controls expected at the client, and the services of subservice providers, whose controls are either included in or carved out of the examination. A Type 1 report gives the service auditor's opinion on the description and the design of controls as at a date; a Type 2 report also covers whether the controls operated effectively over a period.
In the United States, SOC 1 examinations are performed under AT-C section 320 of the AICPA attestation standards, from SSAE No. 18, in effect since 1 May 2017; internationally, the equivalent is ISAE 3402, issued by the IAASB. The report is used by clients, called user entities, and their auditors. SOC 1 is relevant to service organisations such as payroll, loan servicing, insurance and medical claims, fund administration, finance and accounting outsourcing and hosted financial systems.
SOC 1 (ISAE 3402 / SSAE 18) at a glance
- Purpose
- Independent assurance for your clients and their auditors about the controls over the transactions you handle that affect their financial statements
- Relevant to
- Service organisations whose processing reaches clients' financial reporting: payroll, loan servicing, insurance and medical claims, fund administration, finance and accounting outsourcing, and hosted financial systems
- Edition
- AT-C section 320 of the AICPA attestation standards, from SSAE No. 18 and in effect since 1 May 2017; internationally, ISAE 3402, issued by the IAASB in December 2009
- Attestation
- Examined and reported on by a CPA firm acting as service auditor, or by a service auditor reporting under ISAE 3402; Type 1 as at a date, Type 2 over a period
- Sterling's role
- Gap analysis, control objectives and the system description written with your team, Effivity, training, readiness testing and fieldwork support, then Sustain™ through each renewal
- Cost and timing
- Total investment for a SOC 1 control environment depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months to a Type 1 report and 10 to 18 months to a first Type 2 report
SOC 1 (ISAE 3402 / SSAE 18): questions people ask
Is SOC 1 a certification?
No. There is no SOC 1 certificate, no public register and no pass mark. A SOC 1 report contains an independent service auditor's opinion on management's description of your system and on the design of your controls and, in a Type 2, on their operating effectiveness, with the tests performed and their results. Anyone offering to make you "SOC 1 certified" or "SSAE 18 certified" is describing something neither standard provides.
SOC 1 or SOC 2: which report do our clients need?
Ask what they will use it for. SOC 1 covers controls relevant to your clients' financial reporting and is read by their finance teams and external auditors. SOC 2 covers security and, where chosen, availability, processing integrity, confidentiality and privacy, and is read by security and procurement teams. Payroll, claims and fund processors are often asked for both; one control environment can support both.
What is the difference between SSAE 18 and ISAE 3402?
They are two standards for the same kind of report. SSAE 18, through AT-C section 320, is the AICPA standard CPA firms follow in the United States; ISAE 3402 is the IAASB's international equivalent. Which one your report follows depends on what your clients' auditors expect and on the service auditor you appoint, so confirm both before the engagement letter is signed.
Type 1 or Type 2: which report should we get first?
A Type 1 covers management's description and the design of your controls as at a date. A Type 2 adds whether the controls operated effectively throughout a period, which is what a client's auditor needs if it intends to rely on them. If a client is waiting, a Type 1 now with the Type 2 period already running is often sensible; if there is time, going straight to a Type 2 saves an examination.
Who writes the control objectives?
Your management does, for the services your clients use, and the objectives have to address what could go wrong in your processing that would matter to their financial reporting. Clients' auditors may say which areas they expect to see covered. The CPA firm evaluates the description, the objectives and the controls; it does not write them for you. Sterling helps you write them.
Keep exploring
Related to this video
Read next
Services
The complete guide
Everything on SOC 1 (ISAE 3402 / SSAE 18)
Start with the SOC 1 (ISAE 3402 / SSAE 18) page, or go straight to the guide you need.
On the SOC 1 (ISAE 3402 / SSAE 18) page
Guides
Often combined with SOC 1 (ISAE 3402 / SSAE 18)
More videos: Financial services, payments and AML
Talk to a consultant
Plan your SOC 1 attestation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice