Purpose
Provide user auditors and user entities with independent information about controls at a service organization that affect financial reporting.
SOC 1 • ICFR • SSAE 18
SOC 1 audit report services for ICFR-relevant controls.
A SOC 1 report is an independent CPA attestation about controls at a service organization that are relevant to user entities' internal control over financial reporting (ICFR). CyberAtrix prepares the system, controls and evidence — a licensed service auditor issues the report.
01 / The SOC 1 answer
What is a SOC 1 report?
A SOC 1 report is an attestation report issued by an independent licensed CPA firm under AICPA SSAE 18 (Statement on Standards for Attestation Engagements). It reports on controls at a service organization that are relevant to user entities' internal control over financial reporting (ICFR). In short: SOC 1 is about the controls customers' financial auditors care about — not about security posture in general.
Framework
Issued under AICPA attestation standards (SSAE 18 — AT-C 105 and AT-C 205) with a system description, management assertion and service auditor's report.
Distribution
Restricted-use report intended for management, their auditors and other specified parties with sufficient knowledge of the system.
Important: SOC 1 is an attestation report, not an ISO-style certification. The report and opinion are issued by an independent service auditor — CyberAtrix can prepare but does not issue the SOC 1 report.
What the report contains: management's system description, management's written assertion, and the service auditor's opinion. For SOC 1 Type 2, the report also describes the service auditor's tests of controls and the results of those tests.
02 / Why SOC 1 is needed
Why do organizations pursue SOC 1?
SOC 1 exists because financial auditors of user entities need to understand how a service organization's controls affect the financial statements their clients produce. Where services touch payment processing, payroll, transaction records, claims, invoices, reconciliations or financial data flows, the user entity's auditor usually expects SOC 1 evidence.
User auditor need
Financial auditors rely on the SOC 1 report to plan their audit of the user entity's financial statements.
Customer expectation
Customers with financial reporting obligations often require SOC 1 as part of vendor due diligence.
Contractual demand
Master services agreements increasingly name SOC 1 as a mandatory assurance deliverable.
Control discipline
The examination pushes the service organization toward repeatable, owned, evidenced controls.
Not the same as SOC 2: SOC 2 is about Trust Services Criteria — security, availability, processing integrity, confidentiality and privacy. SOC 1 is about ICFR-relevant controls. Many service organizations maintain both.
03 / Who needs SOC 1
Who is SOC 1 for?
SOC 1 applies to service organizations whose services are relevant to their customers' financial reporting. If your platform, operations or processes influence the numbers your customers report, their auditors may expect a SOC 1 report.
Payroll & HR processors
Wage calculations, tax filings, benefits deductions and payments that flow into customer financials.
Claims processors & TPAs
Insurance and healthcare claims processing that affects customer reserves, payables and receivables.
Fund administrators & custodians
Asset servicing, valuations, NAV calculations and investor-level reporting.
SaaS platforms with financial data
Billing, revenue systems, subscription platforms and financial-data SaaS used by customer finance teams.
Transaction & payment processors
Card processing, ACH, ledger services and other transaction infrastructure that touches customer financial records.
Cloud hosting for financial systems
Hosting and infrastructure providers where customers rely on the provider's controls for financial reporting integrity.
Not mandatory by law: SOC 1 is driven by customer expectations, audit dependency, contractual requirements and risk, not by a statutory mandate. Cybersecurity-focused services with no financial reporting impact are usually better served by SOC 2.
04 / Compare the reports
SOC 1 Type 1 vs Type 2
The core distinction is time. Type 1 covers the fairness of the description and the suitability of control design as of a point in time. Type 2 also tests whether the controls operated effectively throughout a specified period.
| Dimension | SOC 1 Type 1 | SOC 1 Type 2 |
|---|---|---|
| Primary question | Is the system description fair, and are the relevant controls suitably designed as of a date? | Additionally, did the controls operate effectively throughout a specified period? |
| Time frame | As of a specific date. | For a specified period of time. |
| Testing detail | Design and implementation focus. | Service auditor tests of controls and results. |
| Best fit | First-time reporting and early customer assurance. | Sustained assurance for user auditors across a period. |
| Commercial signal | Milestone for vendor readiness. | Stronger evidence expected by many financial auditors. |
05 / ICFR flow
How service-organization controls reach user financial reporting
SOC 1 exists to close the gap between a service organization's controls and the financial statements of the entities it serves.
Diagram — ICFR flow from service organization to user financial reporting
The service organization's controls sit upstream of the user entity's financial reporting. The user auditor relies on the SOC 1 report to understand and factor those controls into the audit.
06 / ICFR control domains
The five ICFR control domains in a SOC 1 report
Most SOC 1 controls cluster around five areas. Which ones matter depends on the service, the data flows and the user auditor's expectations.
Diagram — ICFR control environment wheel
Five ICFR control domains radiate from the service organization center. Together they produce the evidence a service auditor examines.
Transaction processingCompleteness, accuracy, validity, authorization and timeliness of transactions.
Access managementAuthentication, authorization, provisioning and de-provisioning of access to financial systems.
Change managementAuthorized, tested and approved changes to systems that affect financial reporting.
Reconciliations & data integrityReconciliations, exception handling, integrity checks and interfaces between systems.
Governance & oversightRisk assessment, oversight, policy lifecycle and management review of the control environment.
07 / Audit lifecycle
How a SOC 1 examination runs
Most SOC 1 programs move through six phases. Type 2 adds an operating window between readiness and examination.
Diagram — SOC 1 audit lifecycle
From scope definition through readiness, evidence, observation, examination and report issuance. Type 1 skips the observation window; Type 2 includes it.
Type 1 vs Type 2 timeline: Type 1 can often be completed in weeks after readiness. Type 2 adds the observation window (commonly 3–12 months) plus examination and reporting time.
08 / Benefits
Business benefits of a SOC 1 report
A SOC 1 report is more than a compliance artifact — it reduces friction in enterprise sales and strengthens the control environment.
Faster customer due diligence
Customers and their auditors get a single, independent report instead of repeated questionnaires and site visits.
Stronger enterprise deals
Financial-services, healthcare and large-enterprise buyers often require SOC 1 before contracting.
Reduced audit burden
User auditors can rely on the report, reducing requests that flow back to your operations teams.
Control discipline
Owners, frequencies and evidence become explicit — improving operational consistency.
Risk reduction
Gaps in financial-reporting controls are found and fixed before they become incidents.
Competitive differentiation
A clean SOC 1 Type 2 signals maturity to prospects evaluating vendors.
09 / Key features
What a SOC 1 examination covers
The service auditor examines the system description and the controls management asserts are relevant to user entities' ICFR.
System description
Management's description of services, infrastructure, software, people, procedures, data and subservice organizations.
Control objectives
Objectives relevant to financial reporting — completeness, accuracy, validity, authorization, timeliness and data integrity.
Control activities
The specific controls designed to meet each objective, with owners, frequencies and evidence expectations.
Tests of controls
For Type 2, the service auditor's procedures and the results of those procedures across the period.
CUECs
Complementary user entity controls that customers must perform for the service organization's controls to work.
Subservice organizations
Carve-out or inclusive treatment of vendors that perform part of the system.
Management assertion
Management's written assertion about the fairness of the description and suitability of control design.
Service auditor's opinion
The independent CPA firm's conclusion — the core output relied upon by user auditors.
10 / Scope
Scoping the SOC 1 system
The system description defines what is in scope. Scoping too broadly creates unnecessary work; scoping too narrowly risks rejection by user auditors.
ServicesThe specific services provided to user entities that affect financial reporting.
InfrastructureData centers, cloud environments, networks and supporting technology.
SoftwareApplications, databases and tools used to process transactions and data.
People & proceduresPersonnel, roles, manual and automated procedures that operate controls.
Data & subservice orgsData flows, interfaces and vendors that perform part of the system.
Scoping tip: Start from the user entity's financial statements. Work backwards to the transactions and data your service touches, then identify the controls that matter.
11 / Readiness checklist
SOC 1 readiness checklist
Use this checklist to assess whether your organization is ready to begin a SOC 1 examination.
Governance & scope
- Executive sponsor identified
- System scope documented
- User entities and financial dependencies mapped
- Subservice organizations identified
- Carve-out or inclusive method decided
Controls & evidence
- ICFR control inventory created
- Control owners assigned
- Frequencies and evidence defined
- CUECs documented
- Evidence calendar in place
Policies & procedures
- Policies approved and current
- Procedures documented and followed
- Change management records maintained
- Access reviews performed
- Reconciliations completed and reviewed
Examination readiness
- Service auditor selected
- System description drafted
- Management assertion drafted
- Evidence organized by control
- Walkthroughs scheduled
Downloadable checklist: Request the full SOC 1 readiness checklist from CyberAtrix.
12 / Cost, timeline & effort
SOC 1 cost, timeline and effort
Fees and duration depend on scope, control count, locations, subservice organizations, evidence maturity and the service auditor selected. The figures below are planning ranges, not quotes.
Type 1
Timeline: 4–10 weeks after readiness.
Effort: Moderate — design and description focus.
Cost drivers: Scope, controls, locations.
Type 2
Timeline: Observation window (3–12 months) + examination and reporting.
Effort: High — evidence across the period.
Cost drivers: Window length, control count, testing.
Readiness (optional)
Timeline: 2–8 weeks depending on gaps.
Effort: Variable — gap closure and control design.
Cost drivers: Current maturity, documentation.
Note: CyberAtrix quotes readiness and preparation work separately from the independent CPA firm's examination fees. The service auditor sets their own fees.
13 / SOC 1 vs SOC 2 vs SOC 3
How SOC 1 compares to SOC 2 and SOC 3
All three are AICPA attestation reports, but they answer different questions for different audiences.
| Dimension | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| Focus | ICFR-relevant controls | Trust Services Criteria | Trust Services Criteria (general use) |
| Audience | User entities & their auditors (restricted) | User entities & their auditors (restricted) | General public (general use) |
| Detail | System description, controls, tests (Type 2) | System description, controls, tests (Type 2) | Summary only, no detailed tests |
| Common drivers | Financial reporting dependency | Security, availability, confidentiality | Marketing & trust signaling |
14 / AICPA, CPA & service auditor
The role of the AICPA, CPA and service auditor
SOC 1 is governed by AICPA standards and issued by an independent licensed CPA firm. Understanding the roles helps you plan the engagement.
AICPA
Publishes the attestation standards (SSAE 18) and guidance that govern SOC 1 examinations.
Service auditor (CPA firm)
Performs the examination, tests controls and issues the SOC 1 report. Must be independent of the service organization.
Management
Prepares the system description and written assertion, and is responsible for the controls.
CyberAtrix role: We prepare, design, document and coordinate — we do not issue the SOC 1 report. The report is issued by an independent licensed service auditor.
15 / CyberAtrix support
How CyberAtrix supports your SOC 1 program
We provide end-to-end readiness and preparation services, then coordinate with your chosen service auditor.
01
SOC 1 readiness assessment
Gap analysis against description criteria and control objectives.
02
Scoping & system description
Define the system and draft management's description.
03
ICFR control design
Design controls, owners, frequencies and evidence expectations.
04
Type 1 preparation
Prepare for point-in-time examination and assertion.
05
Type 2 preparation
Set up the operating period and evidence program.
06
Evidence management
Organize evidence by control and maintain the evidence calendar.
07
CUEC & subservice scoping
Document complementary controls and carve-out/inclusive decisions.
08
CPA examination coordination
Liaise with the service auditor, manage requests and walkthroughs.
16 / Why CyberAtrix
Why teams choose CyberAtrix for SOC 1
Practical, audit-ready preparation grounded in real user-entity dependencies — not generic templates.
ICFR FOCUS
Financial-reporting lens
We scope from the user entity's financial statements backwards, keeping the control set lean and relevant.
EVIDENCE FIRST
Evidence that holds up
Controls are designed with the evidence in mind, so Type 2 testing doesn't collapse under scrutiny.
CPA COORDINATION
Auditor-ready handoff
We prepare the description, assertion and evidence matrix so the service auditor can start efficiently.
CUEC CLARITY
Clean customer responsibilities
CUECs and subservice treatment are documented clearly, reducing back-and-forth with user auditors.
INTEGRATED PROGRAMS
SOC 1 + SOC 2 together
Overlapping controls are mapped once, so both reports benefit from a single control program.
EXPERIENCE
ISO 27001 LA-LI led
Led by Rakesh H Kotian, ISO/IEC 27001 Lead Auditor & Lead Implementer, with GRC and assurance experience.
Ready to scope your SOC 1 program?Talk to CyberAtrix about readiness, control design and CPA coordination.
17 / About the author
Written and reviewed by
Rakesh H Kotian
Chief Executive Officer · CyberAtrix Private Limited
ISO/IEC 27001 Lead AuditorISO/IEC 27001 Lead Implementer
Rakesh leads SOC 1, SOC 2, ISO 27001 and GRC assurance engagements at CyberAtrix. He has supported service organizations across payroll, SaaS, BPO and financial-processing sectors in preparing for independent CPA examinations.
CyberAtrix structured our SOC 1 Type 2 controls around real user-entity dependencies and got us to a clean first report. The evidence matrix paid for itself.
Controller
Payroll Service Provider
We combined SOC 1 and SOC 2 into one program. CyberAtrix kept the ICFR scope lean and audit-ready.
VP Engineering
SaaS Financial Platform
Clear walkthroughs of CUECs and carve-out vs inclusive for our subservice relationships. Very practical.
Head of Risk
BPO Services
18 / FAQ
SOC 1 frequently asked questions
Answers to the questions we hear most often from service organizations and their auditors.
What is a SOC 1 report?
A SOC 1 report is an attestation report issued by an independent CPA firm under AICPA SSAE 18. It reports on controls at a service organization that are relevant to user entities' internal control over financial reporting (ICFR).
What is ICFR in a SOC 1 context?
ICFR stands for Internal Control over Financial Reporting. In SOC 1, ICFR means controls at the service organization relevant to the user entity's financial statements — for example transaction processing, change management, access and reconciliations.
What is the difference between SOC 1 Type 1 and Type 2?
SOC 1 Type 1 covers the fairness of the description of controls and the suitability of control design as of a point in time. SOC 1 Type 2 also tests whether the relevant controls operated effectively throughout a specified period.
Is SOC 1 the same as SOC 2?
No. SOC 1 focuses on controls relevant to user entities' financial reporting. SOC 2 focuses on controls relevant to Trust Services Criteria — security, availability, processing integrity, confidentiality and privacy.
Who needs a SOC 1 report?
Service organizations whose services affect their customers' financial reporting. Common examples include payroll providers, claims processors, fund administrators, SaaS platforms affecting financial data, transaction processors, and cloud hosting where customers depend on its controls.
Is SOC 1 mandatory?
SOC 1 is not a statutory requirement. It is driven by customer demands, audit requirements, contract expectations, and the service organization's role in its customers' financial reporting.
Who issues the SOC 1 report?
The SOC 1 report is issued by an independent licensed CPA firm (the service auditor) under AICPA attestation standards. Management prepares the system description and assertion.
What standard governs SOC 1?
SOC 1 examinations are performed under AICPA attestation standards, including SSAE 18 (AT-C 105 and AT-C 205) — the Statement on Standards for Attestation Engagements.
What is a complementary user entity control (CUEC) in SOC 1?
CUECs are controls expected to be performed by the user entity for the service organization's controls to work effectively. They are described in the SOC 1 report so user auditors can factor them in.
What is a subservice organization in SOC 1?
A subservice organization is a vendor used by the service organization to perform part of the system. It can be included (inclusive method) or carved out (carve-out method) from the SOC 1 examination.
Is SOC 1 a certification?
No. SOC 1 is an attestation report issued by an independent CPA firm — not an ISO-style certification.
How long is a SOC 1 Type 2 observation period?
Management and the service auditor agree a specified period of time. Common planning windows are three, six, nine or twelve months, depending on customer expectations, control maturity and cycle length.
How much does a SOC 1 audit cost?
Fees depend on system scope, number of controls, locations, subservice organizations, evidence maturity and the CPA firm. Type 2 is typically higher than Type 1. CyberAtrix quotes readiness work separately from CPA examination fees.
How long does a SOC 1 audit take?
Readiness commonly takes several weeks to a few months. Type 2 adds an observation window. Examination and reporting add additional weeks. End-to-end planning often spans three to nine months.
Can we go straight to SOC 1 Type 2?
Yes, if controls are already designed, implemented and producing evidence. Type 1 is not a mandatory prerequisite.
What is included in a SOC 1 report?
A SOC 1 report includes management's system description, management's written assertion, and the service auditor's report including the opinion and, for Type 2, tests of controls and results.
Who can read a SOC 1 report?
SOC 1 reports are restricted-use. They are intended for management of user entities, their auditors, and other specified parties with sufficient knowledge of the system and controls.
What is the role of COSO in SOC 1?
Many service organizations use the COSO Internal Control — Integrated Framework as a reference for structuring ICFR controls. COSO is not required by SSAE 18, but it is a widely recognized internal control framework.
What is the difference between SOC 1 and ISO 27001?
SOC 1 is an attestation report on controls relevant to user entities' financial reporting. ISO/IEC 27001 is a management-system standard for information security, with optional independent certification. They serve different purposes.
Does CyberAtrix issue the SOC 1 report?
No. CyberAtrix provides readiness, control design, evidence preparation and examination coordination. The report is issued by an independent licensed service auditor.
What evidence does a SOC 1 examination require?
Common evidence includes policies, procedures, control ownership, tickets, approvals, logs, reconciliations, access reviews and management oversight. Evidence must support the description and, for Type 2, the operating period.
Can SOC 1 and SOC 2 be done together?
Yes. Many service organizations maintain a SOC 1 report for financial-reporting controls and a SOC 2 report for security, availability or confidentiality. The control sets overlap and can be integrated into one program.
SOC 1 auditSOC 1 reportSOC 1 Type 1SOC 1 Type 2ICFRSSAE 18AICPASOC 1 vs SOC 2SOC 1 readinessSOC 1 costSOC 1 timelineservice auditorfinancial reporting controlsCyberAtrix
FREE DOWNLOAD
SOC 1 readiness checklist for service organizations
A practical checklist covering governance, scope, ICFR controls, evidence, CUECs and CPA examination preparation.
- Scope & system description prompts
- ICFR control inventory template
- Evidence calendar structure
- CUEC and subservice scoping guide
- Service auditor handoff checklist
- Type 1 vs Type 2 decision guide
Download Checklist ↓Book a Consultation →No obligation. We'll respond within one business day.
Next step
Build a SOC 1 program your customers' auditors can rely on.
CyberAtrix prepares your system, controls and evidence — then coordinates with your independent CPA service auditor.