SOC 1 Audit
Under SSAE 18
A SOC 1 report evaluates a service organization's controls relevant to its user entities' internal control over financial reporting (ICFR). Our SOC 1 examinations demonstrate the reliability of the processes that affect your customers' financial statements, for companies in the U.S. and Latin America.
Which SOC 1 report does your organization need?
Both reports are issued under the AICPA's SSAE 18 attestation standard (AT-C Section 320). They differ in what they evaluate and over what period. This comparison summarizes the factors that drive the decision.
| Criteria | SOC 1 Type 1Design | SOC 1 Type 2Operating effectiveness |
|---|---|---|
| Primary focus | The auditor's opinion covers whether the system description is fairly presented and whether controls are suitably designed and implemented. | In addition to design, the opinion covers the operating effectiveness of controls throughout the examination period. |
| Period covered | A specific date — a single point in time (e.g., "as of December 31, 2025"). The report does not express an opinion on what happened before or after that date. | A continuous period, typically 6 to 12 months (e.g., "January 1 through December 31, 2025"). The report covers the entire period. |
| Type of evidence | Evidence that controls are suitably designed to achieve the control objectives stated by management. | Evidence, obtained through sample-based testing, that controls operated effectively throughout the entire period. |
| Best suited for | Organizations undergoing a SOC 1 audit for the first time or that have recently made significant changes to their systems. | Organizations with mature processes whose enterprise customers and external auditors require assurance that controls operate effectively. |
| Timeline | The estimated time from kickoff to report issuance depends on scope; typically 1 to 1.5 months. | The estimated time is 1.5 to 3 months. |
| Market demand | Entry point — demonstrates that your controls are suitably designed. | The most requested report among enterprise customers and external auditors. |
Note: A SOC 1 report provides reasonable assurance, not a guarantee. Both Type 1 and Type 2 reports may include documented deviations; their presence does not invalidate the report and is typically accompanied by management's response. Timelines shown are estimates and depend on the scope of each engagement.
Which companies need a SOC 1 report?
Service organizations that process, store, or affect their customers' financial information are the primary candidates for a SOC 1 report under SSAE 18.
| Type of company | Service provided | Impact on financial processes | Why it needs SOC 1 |
|---|---|---|---|
| Accounting BPO | Outsourced accounting | Processes customers' accounting records and financial statements | Demonstrates financial reliability |
| Payroll processors | Payroll calculation and payment | Directly affect customers' expenses and records | Payroll accuracy and control |
| SaaS / accounting ERP companies | Cloud accounting platforms | Manage financial data, balances, and reports | Secure, reliable software |
| Clearing banks | Financial transaction processing | Intermediate transactions recorded in customers' books | Process integrity and accuracy |
| E-invoicing providers | Invoice issuance and validation | Affect tax and accounting information | Sound billing controls |
| Funds / trust companies | Third-party investment management | Control assets that affect financial statements | Independent assurance over asset management |
| Financial outsourcing | Accounts payable / receivable | Affect customers' cash flow and balances | Transparent financial processes |
| Data centers hosting ERPs | Hosting of financial systems | Their availability affects accounting operations | Independently tested IT controls |
| FinTech companies | Payments, loans, and credit | Handle financial data and money flows | Trust with regulators and banks |
| Payroll software / HR tech | Payroll automation | Affect labor costs and financial records | Accuracy, privacy, and control |
Everything about the SOC 1 report (SSAE 18)
The most common questions from those receiving a SOC 1 report request for the first time. Tap each question to see the answer.
What is a SOC 1 report?
A SOC 1 report is an attestation report issued by a CPA firm under the AICPA's SSAE 18 standard (AT-C Section 320). It evaluates the internal controls relevant to financial reporting (ICFR) of a service organization.
In other words: it demonstrates whether the processes your company manages can reliably (or not) affect your clients' financial statements. It's the report typically required by your clients' external auditors when your service impacts their accounting.
SSAE 18 · AT-C Section 320Is SOC 1 a certification?
No. SOC 1 is not a certification granted by a body. It's an attestation report in which an independent CPA auditor issues a professional opinion on the design and/or operation of your financial controls.
Important nuance: the correct phrasing is "obtain a SOC 1 report," not "get SOC 1 certified." No provider "certifies" you in SOC 1.
What is ICFR and why is it at the core of SOC 1?
ICFR (Internal Control over Financial Reporting) refers to the internal controls relevant to financial reporting: the processes that ensure the data ending up in your clients' financial statements is accurate, complete, and reliable.
SOC 1 exists specifically so that service organizations (such as payroll processors or accounting BPOs) can demonstrate to their clients' external auditors that their controls over that data are sound.
How does SOC 1 differ from a traditional financial audit?
A traditional financial audit gives an opinion on whether your own financial statements are fairly presented. SOC 1 gives an opinion on whether your internal controls are reliable enough for the auditors of other companies (your clients) to rely on them when auditing those clients' financial statements.
What is a SOC 1 report for? What are its benefits?
A SOC 1 report lets you:
- Meet the requirement your clients' external auditors ask for
- Avoid repeated individual audits — the same report serves all your clients with the same scope
- Build trust with current clients and prospects
- Detect and fix control weaknesses before they cause a problem
- Stand out from competitors without a SOC report
What is the difference between SOC 1 Type I and Type II?
| Criterion | SOC 1 Type I (design) | SOC 1 Type II (effectiveness) |
|---|---|---|
| Primary focus | Evaluates whether the controls are adequately designed and implemented | Evaluates the design and verifies the operating effectiveness of the controls |
| Time dimension | Performed as of a specific date (e.g., "as of December 31") | Covers a continuous period, usually 6 to 12 months |
| Ideal use case | Companies being audited for the first time | Companies with mature processes whose external auditors require annual assurance |
Type II is the most requested by your clients' external auditors.
Should I go with a SOC 1 Type I or a Type II?
If it's your first year being audited or you've just implemented structural changes, a Type I is the reasonable entry point. If your clients and their external auditors need assurance about the ongoing operation of your controls, you need a Type II — which is usually requested every year as a recurring report.
How does SOC 1 differ from SOC 2?
SOC 1 evaluates controls that impact your clients' financial information (ICFR). SOC 2 evaluates the Trust Services Criteria: security, availability, integrity, confidentiality, and privacy.
- If your processes affect financial statements → SOC 1
- If your clients' concern is data security → SOC 2
- A payroll or billing processor usually needs both
How does SOC 1 differ from SOC 3?
SOC 3 is not a public version of SOC 1 — SOC 3 is derived solely from SOC 2, since it summarizes the Trust Services Criteria for public distribution. SOC 1, because it contains sensitive financial information about your clients, has no equivalent public version: it is always distributed on a restricted basis.
What kinds of companies need a SOC 1 report?
It's common in:
- Accounting BPOs and payroll processors
- Accounting SaaS / ERP companies
- Clearing banks and e-invoicing providers
- Funds and trust companies
- Financial outsourcing (accounts payable/receivable)
- Data centers hosting financial systems
- Fintechs that process payments, loans, or credit
In general: any organization whose service impacts its clients' records or financial statements.
How do I know if my company needs a SOC 1?
If you answer yes to any of these questions, you should consider it:
- Has your client's external auditor asked you for a SOC 1 report?
- Do your processes generate or modify data that ends up in your clients' financial statements?
- Do you process payroll, billing, payments, or investments on behalf of third parties?
Which controls does a SOC 1 evaluate exactly?
The scope is defined based on your operation, but typically includes controls over:
- Transaction processing (input, calculation, recording)
- Data reconciliations and validations
- Access and segregation of duties over financial systems
- Change management for systems that process financial data
We define it with you before starting, based on which of your processes impact your clients' financial statements.
How long does a SOC 1 audit take?
- SOC 1 Type I: between 1 and 1.5 months from kickoff to issuance.
- SOC 1 Type II: requires the observation period (6 to 12 months) plus an additional 1.5 to 2.5 months of execution and issuance.
Reports are valid for one year.
Managing expectations: if your client wants a Type II "now" and you don't have any observation period running yet, the realistic path is to start with a Type I while the history accumulates for the Type II.
What evidence is requested in a SOC 1 audit?
It depends on scope, but typically:
- Internal control policies and procedures
- Control matrices
- Transaction and reconciliation samples
- System reports and access logs
- Segregation of duties
- For Type II: evidence of control operation throughout the entire period
Do I need to prepare before a SOC 1 audit?
If your internal controls are not yet documented and operating consistently, a prior readiness process is advisable.
Independence: AICPA standards do not allow the same firm that helps you prepare your controls to then be the one that audits you. We guide you, but that work is done by an independent third party.
What happens if deviations are found in the controls?
A SOC 1 is not a pass/fail exam. Deviations are documented, their impact is assessed, and they are included along with management's response. They do not automatically invalidate the report.
How often should a SOC 1 report be renewed?
SOC 1 reports are valid for one year. Your clients' external auditors generally require a report less than 12 months old in order to rely on it during their own financial audit.
Is SOC 1 recognized outside the United States?
Yes. SOC 1 under SSAE 18 is widely recognized in the U.S. and internationally. Its content is substantially equivalent to the IAASB's ISAE 3402, so we can issue dual-use SOC 1 + ISAE 3402 reports for clients with requirements outside the U.S.
Equivalent to ISAE 3402 (IAASB)Do you offer SOC 1 audits in Latin America?
Yes. We work with financial and accounting service companies in the United States, Colombia, Mexico, Chile, Peru, Argentina, Panama, Costa Rica, Ecuador, and more countries. We serve clients in English and Spanish, making coordination with your local team and your clients' U.S. auditors easier.
Who can issue a valid SOC 1 report?
Only a registered CPA firm with an active license from a State Board of Accountancy can issue a valid SOC 1 report under SSAE 18. Next Assurance meets all these requirements and has coverage in the U.S. and across Latin America.
Can I share my SOC 1 publicly? No — unlike SOC 2/SOC 3, SOC 1 contains sensitive financial information and is always distributed on a restricted basis, only to your clients and their external auditors.
How much does it cost? There's no single fee: it depends on the scope (processes and controls involved), the size of the operation, and whether it's Type I or Type II. We define the scope with you before quoting.
Did a client ask you for a SOC report?
Choose the option that best describes your situation — we'll take you straight to what you need.