Management, compliance & auditing

SOC 1 compliance: Everything your organization needs to know

What does SOC 1 stand for?

SOC 1 stands for System and Organization Organization Controls (SOC) 1. This is one of the types of compliance reports offered by the American Institute of CPAs (AICPA).

What is SOC 1 compliance?

SOC 1 compliance is an independent validation of a service provider’s controls that relate to financial planning. In essence, if a service provider may impact the financial reporting of their customers, the customer may need to be able to audit their providers to ensure that financial data is being properly protected. Instead of undergoing individual audits by each customer, a service provider can undergo an SOC 1 compliance audit and present the results to its customers.

What is an SOC 1 report?

A CPA generates an SOC 1 report to verify that a service provider meets the criteria for SOC 1 compliance. This report is generated at the close of the audit. It can then be presented to customers who require information about their service providers for financial reporting.

A service provider can undergo either a Type 1 or a Type 1 SOC 1 audit. These two types of audits differ mainly in their scope and duration:

• Type 1: a snapshot of an organization’s compliance status. The auditor comes in and tests one of the service provider’s controls against the company’s description and design. If the control meets the required criteria, the company is granted an SOC 1 Type 1 compliance report.
• Type 2: verifies that an organization can sustain compliance across all controls. Instead of a single audit, the CPA will assess the organization’s controls for a set period of time (six months, a year, etc.). If the company passes this assessment, then they are granted an SOC 1 Type 2 compliance report.

In general, customers looking for SOC 1 compliance are likely looking for a Type 2 report. This demonstrates that a service provider has the ability to sustain a compliant status for an extended period rather than ramping up controls suddenly for an audit and abandoning them once a compliant rating has been achieved.

SOC 1 vs. SOC 2

SOC 1 is one of several different types of SOC audits. The other big one is an SOC 2 report.

An SOC 2 report is geared mainly towards providers of technical services. For example, a cloud services provider may undergo an SOC 2 audit to demonstrate that they have the controls in place that are required to provide services to their customers.

SOC 2 audits are performed against one or more Trust Services Criteria (TSCs), including security, confidentiality, availability, processing integrity and privacy. Any SOC 2 audit will include an evaluation against the Security TSC. Still, a service provider may also opt to undergo an evaluation against the criteria associated with any or all of the other four.

SOC 1 and SOC 2 reports evaluate a service provider’s ability to provide contracted services to their customers. However, they have very different focuses. An SOC 1 audit focuses on the service provider’s impact on a customer’s financial reporting. At the same time, an SOC 2 report deals with the service provider’s ability to provide services securely.

SOC 1 vs. SOC 3

SOC 3 compliance covers many of the same areas as SOC 2 compliance but is intended for a different audience. An SOC 2 report is created for a “professional” audience, such as a customer’s auditors, stakeholders etc. An SOC 3 report is intended for a general audience and is published for public consumption. For example, cloud services providers like AWS, GCP and Azure will publish an SOC 3 report on their websites for the public but might send an SOC 2 report to corporate customers upon request.

The different intended audience for SOC 3 reports makes them even more distant from SOC 1 reports. Not only do they contain different types of data (financial reporting vs. information about an organization’s ability to provide services), but they are also designed for different audiences since SOC 1 is also intended for a professional audience.

SOC 1 compliance checklist

The AICPA does not publish a formal checklist for achieving SOC 1 compliance. However, an organization looking to undergo an SOC 1 audit should take the following steps:

• Choose the right report: SOC 1 audits are designed for organizations with access to customers’ financial data. If you do not transmit, process or store financial data, then an SOC 2 or SOC 3 audit may be a better choice.
• Define control objectives: an SOC 1 report is designed to evaluate whether its controls meet their control objectives. These control objectives should manage customers’ risks regarding financial reporting.
• Map controls to control objectives: after defining controls, an organization should identify the controls that meet these objectives and identify any control gaps.
• Close identified gaps: if during the previous step any control gaps are identified, the organization should define policies, procedures or controls to fill them.
• Engage an auditor: SOC 1 compliance is evaluated by a CPA firm. Ideally, select one with experience performing SOC 1 audits for organizations within your industry.

 

Sources

• SOC 1 vs. SOC 2 vs. SOC 3, WorkOS
• System & Organization Controls (SOC) Reporting, Baker Tilly
• Control Objectives & Activities: What Are They & What’s Appropriate? Linford & Co LLP