SOC 1 Reports: How Auditors Use Them

Many clients send part of their accounting outside the company: payroll to a payroll provider, transaction processing to a payment processor, investment custody to a bank. The provider's controls then become part of the client's internal control over financial reporting. A SOC 1 report is how the client's auditor gets evidence about those controls.

What a SOC 1 report is

A SOC 1 report is an independent auditor's report on a service organization's controls that are relevant to its customers' financial reporting. It is issued under SSAE 18 (AT-C 320) in the US, ISAE 3402 internationally and CSAE 3416 in Canada.

The client is the user entity. Its auditor is the user auditor. The provider is the service organization, and the auditor who issues the report is the service auditor.

Type 1 vs Type 2

	Type 1	Type 2
Covers	Design of controls at a point in time	Design and operating effectiveness over a period, usually 6 to 12 months
Includes tests of controls	No	Yes, with the results and any exceptions
Use for the user auditor	Understanding the controls	Evidence that controls worked, if the auditor plans to rely on them

If the auditor plans to rely on the service organization's controls, a Type 2 report is needed.

SOC 1 vs SOC 2

A SOC 1 report covers controls relevant to financial reporting. A SOC 2 report covers security, availability, processing integrity, confidentiality and privacy, and is aimed at customers' IT and risk teams. A SOC 2 report is not a substitute for a SOC 1 report in a financial statement audit.

What the user auditor does

The standards are AU-C 402 (private companies), ISA 402 and CAS 402, and AS 2601 for public companies.

1. Check the period. It should cover the client's year, or most of it. For the months not covered, get a bridge letter from the service organization and consider other evidence.
2. Check the scope. Make sure the report covers the services and systems the client uses.
3. Read the service auditor's opinion. A qualified opinion, or exceptions in the tests, may mean the controls can't be relied on as planned.
4. Review the complementary user entity controls (CUECs). The service organization's controls only work if the client does its part, such as reviewing payroll reports or restricting who can send payment files. Test the CUECs the audit relies on.
5. Look at subservice organizations. If the report uses the carve-out method, controls at the subservice organization (for example, a data center) are excluded and may need their own report.
6. Consider the service auditor's competence and independence.

Where Warp Accounting fits

Warp Accounting tests the client's side: controls testing on sampled transactions, checking the approvals the firm specifies, with each result linked to its evidence. See controls testing and our guides to the test of controls and segregation of duties.