SOC 1
When your service affects your customers' financial reporting.
Sydney headquartered CPA firm serving Australian and US companies
Controls required for SOX and financial reporting.
SOC 1 is a CPA-issued attestation on the controls at a service organisation that are relevant to its user entities' internal control over financial reporting (ICFR). Like SOC 2, it comes in Type 1 (design at a point in time) and Type 2 (operating effectiveness over a period). It's what your customer's external auditor asks for when your service is in-scope for their financial statement audit.
When you process payments, payroll, billing, claims or any transaction stream that flows into a customer's general ledger, and their auditor needs assurance over the controls at your end. Often required in parallel with SOC 2, not as a replacement for it.
ICFR-relevant controls, no more
We scope SOC 1 narrowly to only the controls that actually flow into a user entity's financial statements, and we test them so the auditor's review of operating effectiveness lands without surprise.
Questions we're often asked.
- Why are we being asked for SOC 1?
- When your service processes transactions or data that flows into your customers' financial statements, such as payments, payroll, billing, claims or ledger entries, their external auditor needs assurance that the controls at your end are designed and operating effectively. SOC 1 is the report they'll ask for so your controls can be relied on during their financial statement audit.
- SOC 1 or SOC 2, or both?
- SOC 1 is about controls that affect your customers' financial reporting. SOC 2 is about security, availability, confidentiality, processing integrity and privacy. If your service touches a customer's books, you'll usually need SOC 1. If it holds their data, you'll usually need SOC 2. Many service organisations need both.
- Type 1 or Type 2 first?
- A Type 1 is faster and can be enough to unblock an initial request, evidencing that your controls are designed appropriately at a point in time. A Type 2 covers a defined period of operation and is what most customers' auditors expect year-on-year. Many companies do a Type 1 first, then transition straight into their first Type 2 window.
- What does 'ICFR-relevant' actually mean?
- A control is ICFR-relevant if a failure could result in a material misstatement in a user entity's financial statements. Scoping SOC 1 well means including those controls and excluding the ones that don't meet that bar, so the report stays defensible and doesn't sprawl.
- What are Complementary User Entity Controls?
- CUECs are the controls your customers need to have in place for your controls to operate as intended. Getting these right avoids a scope gap where risk quietly falls between you and the user entity.
- How long is a typical Type 2 review period?
- Usually 6 or 12 months, aligned to your customers' financial year so the report is usable in their audit. First-year Type 2s sometimes run a shorter window (3 to 6 months) to get the first report out.
How an engagement actually runs.
- 01. ScopingICFR-relevant systems and processes only.
- 02. Control reviewMapped to user-entity financial assertions.
- 03. ReadinessWalkthroughs and evidence rehearsal.
- 04. Audit windowAn iterative, fast-feedback cycle between our audit experts and your team to verify your compliance.
- 05. ReportClean opinion, on time.
Ready when you are
Let's discuss your SOC 1 needs.
A named senior practitioner will lead the conversation and stay accountable from scoping through report issuance.