SOC 1 attestation readiness consulting for a report your clients' auditors can rely on.

What it is

What is SOC 1 and what is it used for?

SOC 1 is an examination of the controls at a service organisation that are likely to be relevant to its clients' internal control over financial reporting. When the payroll you run, the claims you adjudicate, the loans you service or the ledgers you host flow into a client's financial statements, the client and its external auditor need to know whether your controls can be relied on. In the AICPA's terms those clients are user entities and their auditors are user auditors. A SOC 1 report answers their question once, for all of them: a CPA firm acting as service auditor examines your controls and reports its opinion. Outside the United States the equivalent report is issued under ISAE 3402, the IAASB's standard for assurance reports on controls at a service organisation.

Three features set SOC 1 apart. Its subject is your clients' financial reporting, not security or privacy in general; SOC 2 is the report for those. It has no fixed criteria to adopt: the report is built on control objectives that your management writes for the service, the controls that achieve them and the controls your clients must operate themselves, all set out in management's description of the system. And it is not a certificate: the deliverable is a report intended for your management, your clients and their auditors, not a seal to publish. Nor is it ISO/IEC 27001, which certifies an information security management system through an accredited certification body; the two share IT general controls but answer different questions.

Current standards. In the United States, SOC 1 examinations are performed under AT-C section 320 of the AICPA attestation standards. AT-C section 320 comes from SSAE No. 18, issued in April 2016, and has applied since 1 May 2017; the AICPA's current SOC 1 guide is written for examinations under it. Internationally, service auditors report under ISAE 3402, which the IAASB published in December 2009. The AICPA's 2018 description criteria, reissued with revised implementation guidance in 2022, are written for SOC 2; a SOC 1 description is evaluated under AT-C section 320 or ISAE 3402.

Who it is for

Who needs a SOC 1 report?

Demand for SOC 1 comes from your clients' financial statement audits. When a client outsources a process that feeds its general ledger, its auditor has to understand the controls at your end and, to rely on them, obtain evidence that they worked. A report is the efficient way to provide that evidence; without one, each client's auditor may ask to visit and test for itself. The scope should cover the services their financial reporting depends on, and nothing else. Organisations come to Sterling for SOC 1 from four starting points:

• A client or its auditor has asked for your SOC 1 or ISAE 3402 report. It usually arrives while the client's year-end audit is being planned and asks for a Type 2 covering as much of that financial year as possible. We confirm what is being asked and whether a Type 1 now, with a Type 2 period running, meets the date.
• Your processing ends up in your clients' ledgers. Payroll and benefits, loan servicing, insurance and medical claims, fund administration, finance and accounting outsourcing, or a hosted platform where clients keep financial records. If an error in your processing could misstate a client's accounts, SOC 1 is the report its auditor looks for.
• Clients' auditors keep arriving with the same questions. Several clients, several audit firms and several visits a year, each walking through and sampling the same controls. For clients listed in the United States, the audit of internal control over financial reporting also has to take account of controls at service organisations. One report, examined once, answers most of those requests.
• You have a report that is not doing its job. Control objectives that miss what clients' auditors care about, a period ending months before most clients' year-ends, a subservice provider carved out without clear expectations of its controls, or exceptions that recur every year. The objectives and evidence need rebuilding around how the service runs.

The intended benefit is a report your clients' auditors can use when they plan and perform their audits. Its value depends on how your controls operate through the period, not on how the description reads.

Business benefits

How SOC 1 supports client audits and the contracts behind them

A SOC 1 programme should make you easier to audit and harder to replace. We start from the transactions clients trust you with, the points where an input could go unapproved, a reconciliation could be skipped or a system change could alter a calculation, and build the controls around them.

• One report in place of many audit visitsYour controls examined once, by one CPA firm, and used by every client's auditor, instead of repeated walkthroughs, sample requests and site visits.
• Renewals that survive the client's auditA client whose auditor gets what it needs on time has one fewer reason to question the outsourcing arrangement when the contract comes up.
• Errors caught before they reach a client's booksInput checks, authorisations, reconciliations and output reviews defined for each transaction flow, with owners who know what they are looking for.
• Clear responsibility at every hand-offWhat you control, what your subservice providers control and what each client must do itself, written into the report instead of discovered in a dispute.
• No surprises in the opinionOwners, frequencies and evidence for every key control, with exceptions and remediation visible to management during the period, so the likely result is known before the opinion is written.
• A base for SOC 2 and ISO/IEC 27001The IT general controls beneath your SOC 1 objectives are much of what SOC 2 or an ISMS certificate needs, so the next report or certificate starts from evidence you already keep.

Measure what your clients notice: exceptions per period and their causes, how quickly auditor requests are answered, and how many separate client audits the report has replaced. The length of the report is not a result.

Requirements

What are the main SOC 1 requirements?

SOC 1 does not hand you a list of controls or criteria. For each service your clients rely on, you define the control objectives that matter to their financial reporting, operate controls that achieve them, state the responsibilities that sit with clients and subservice providers, and present it all in a description a service auditor can examine. The table is a plain-language map of the elements a SOC 1 report is built from; the description and the controls are evaluated under AT-C section 320 or ISAE 3402 themselves.

Attestation process

How do you get a SOC 1 report?

First define and operate the controls over your clients' transactions. Then an independent CPA firm, acting as service auditor, examines them and issues its report. Sterling prepares your organisation and supports it through fieldwork; the opinion belongs to the service auditor, and its independence is the reason your clients' auditors can use it.

1. 01
   Define the services, the clients and the report.Confirm which services affect clients' financial reporting, which clients and auditors will read the report, SSAE 18 or ISAE 3402, Type 1 or Type 2, and a period that covers as much of your clients' financial years as possible.
2. 02
   Gap analysis: review current processes and controls against draft control objectives.The gap analysis walks each transaction flow, drafts the control objectives, maps existing controls to them, marks what is missing or unevidenced and agrees actions, owners, dates and resources.
3. 03
   Remediate, write the description and start the evidence.Close the gaps, settle the objectives, the complementary user entity controls and the subservice arrangements, draft management's description and begin producing the records each control needs.
4. 04
   Readiness assessment before the as-at date or the period.Sterling walks through and tests the controls the way a service auditor would, so exceptions are fixed before they can appear in the report.
5. 05
   The examination: an as-at date or a period, then fieldwork.For a Type 1 the CPA firm evaluates the description and the design of the controls as at a date; for a Type 2 the controls operate through the agreed period, commonly six to twelve months, and the firm tests them before issuing its report and opinion.
6. 06
   Keep the controls operating into the next period.Reports are usually renewed every year: monitoring continues, bridge letters cover clients whose year-end falls after the period end, and each new period starts where the last one closed.

Check who will sign the report and what it will cover, not just the quoted price. Ask for the CPA firm's licence and peer review status, or the ISAE 3402 service auditor's professional standing, the services and objectives in scope and how subservice organisations will be presented. Be wary of one provider offering to write your controls and sign the opinion, and of any report promised within days: a service auditor cannot report on operation that has not happened, and your clients' auditors will read the dates. How to choose a credible SOC 1 provider

Cost

How much does a SOC 1 report cost?

There is no useful universal price for SOC 1. A payroll bureau running one system from one office needs a different programme from a fund administrator with several platforms, delivery teams in two countries and a hosting provider carved out of its report. What we can promise is a proposal in which every component is visible and nothing is added later.

Timeline

How long does it take to get a SOC 1 report?

Two sets of dates drive the plan: when your first report is needed, and the financial year-ends of the clients who will use it. A Type 1, which reports on the description and the design of your controls as at a single date, is realistic three to six months from kick-off for a service with established processes. A Type 2 needs the controls to operate through a period, commonly six to twelve months, followed by the service auditor's testing and reporting, so a first Type 2 usually arrives ten to eighteen months after the start, with the evidence calendar tracked in Effivity throughout.

Share your clients' deadlines at the start. Often the right sequence is a Type 1 now, a Type 2 period already running and bridge letters from your management covering the months to each client's year-end. A report date quoted before anyone has walked through your processing is a guess, not a plan.

Challenges

Common SOC 1 implementation challenges

SOC 1 programmes tend to stall for five reasons. Each one has a practical answer.

Your engagement

What your SOC 1 engagement includes

Your agreed scope brings together what a control environment and a prepared team need to earn an opinion your clients' auditors can use. Most firms hand over a control template and leave you to assemble the rest; a Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.

• Scope, gap analysis and remediation plan

  The services, clients, report type, standard and period agreed, with responsibilities, dates and decision owners before work starts.

• Control objectives, controls and the system description

  Written with your process owners, finance and IT leads on Sterling's own template sets, including the complementary user entity controls and subservice arrangements.

• Effivity ISO & GRC software

  Your control matrix, evidence calendar, provider reviews and exceptions run in Effivity from day one, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for the people who will test your controls, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Readiness assessment and walkthroughs

  Controls walked through and tested as the service auditor will test them, with exceptions closed before the as-at date or the period.

• CPA-firm coordination and fieldwork support

  Help choosing and briefing the service auditor, populations and samples delivered on time during fieldwork, and support with management's assertion and responses until the report is issued.

The opinion remains with the independent CPA firm acting as your service auditor; Sterling does not issue the report.

How we deliver

How Sterling supports your SOC 1 implementation

Every SOC 1 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Pick the level of support that fits your team's capacity; the method, the software and the accountability do not change.

1. 01
   Design™Guided implementation: your process owners write and operate the controls with Sterling's structure, templates, workshops and coaching.
2. 02
   Drive™Fully managed consulting: Sterling consultants carry the agreed objectives, description, control design and evidence work alongside your team.
3. 03
   Sustain™After the report: control testing through the next period, bridge letters, exception follow-up, refreshers and new-hire training, year after year.
4. 04
   Automate™The control environment running in Effivity: control matrix, evidence, access reviews, changes, providers, exceptions and management reporting in one workspace.
5. 05
   Revise™Changes in scope: new services, clients, systems or locations, the move from Type 1 to Type 2, an added ISAE 3402 or SSAE 18 report, and the extension to SOC 2 or ISO/IEC 27001.

At the start we agree the engagement team, the weekly working session, the deliverables and the decision owners. Progress is reviewed against those commitments throughout, so a weak control is found by us in a walkthrough rather than by the service auditor in a sample.

Often combined with

Standards organisations pair with SOC 1 (ISAE 3402 / SSAE 18)

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.