SOC 1 Outsourcing
Definition
SOC 1 Outsourcing
SOC 1 outsourcing is the use of a provider’s SOC 1 report, which examines controls at a service organisation that bear on its clients’ financial reporting. It answers an auditor’s question, not a security question, and buyers routinely request the wrong one.
The confusion is understandable and expensive.
Three reports share the SOC prefix and cover entirely different ground. Procurement teams ask for whichever one a competitor mentioned — and finance discovers the gap during the audit.
SOC 1 exists for one purpose: so your external auditor can rely on controls operated inside somebody else’s building.
Key takeaways
- SOC stands for System and Organization Controls, not the older Service Organization Control.
- SOC 1 covers controls relevant to clients’ internal control over financial reporting.
- Its intended readers are user entities and the auditors of their financial statements.
- A type 2 report covers operating effectiveness over a period; type 1 covers design at a point.
How it works
The AICPA defines the suite as System and Organization Controls. SOC 1 is described as an examination of controls at a service organization that are likely to be relevant to user entities’ internal control over financial reporting.
The intended audience is unusually specific. The AICPA states the reports are meant for entities that use service organizations (user entities) and the CPAs that audit the user entities’ financial statements (user auditors).
That phrasing decides whether you need one. If outsourced processing touches numbers that reach your financial statements — payroll, billing, claims, collections — your auditor will want it.
If the concern is data security rather than financial accuracy, SOC 1 is the wrong document and SOC 2 is the right one.
Type matters as much as number. A type 1 report assesses whether controls were suitably designed at a single date. A type 2 assesses whether they operated effectively across a period, usually six or twelve months.
| You are buying | Report your auditor wants |
|---|---|
| Payroll processing | SOC 1 type 2 |
| Billing and invoicing | SOC 1 type 2 |
| Cloud hosting for a finance system | SOC 1 and SOC 2 |
| Customer support with no financial effect | SOC 2 only |
| Claims administration | SOC 1 type 2 |
Access is restricted. AWS notes that an NDA is required to review the AWS SOC 1 and SOC 2 reports, which is standard practice across the industry.
Examples
Financial assurance reporting only becomes visible when an external audit starts asking where the numbers came from. The cases below all turn on scope, which is where these arrangements usually fail.
A company outsources payroll and its auditor asks for the provider’s SOC 1 type 2. Without it, the auditor tests the controls directly, and the client pays for that additional work.
A buyer requests a SOC 2 from its billing provider and receives one. The audit still stalls, because security assurance says nothing about the accuracy of invoiced amounts.
A shared services operator holds a SOC 1 covering nine months of a twelve-month audit period. The gap has to be covered by a bridge letter, a routine step in compliance outsourcing practice.
A finance team reads the report properly and finds three exceptions in the testing detail. The opinion at the front was unqualified, which is why the back of the document is the part that matters.
Related terms
Assurance reports, the professionals who produce them and the contractual commitments around them get conflated routinely. Each definition here is a sentence long and says what it deliberately leaves out.
- SOC 2: the security and availability report, addressing entirely different criteria.
- Certified public accountant (CPA): the professional who performs the examination and signs the opinion.
- Compliance outsourcing: buying regulatory capability, rather than obtaining assurance over a provider.
- Service level agreement compliance: meeting contracted performance, which no SOC report assesses.
- Vendor management outsourcing: running supplier assurance, including collecting these reports annually.
- Quality assurance outsourcing: delegating operational checking, unrelated to financial control testing.
- Risk outsourcing: transferring exposure, which obtaining a report does not accomplish.
FAQ
What does SOC stand for?
System and Organization Controls. The older expansion, Service Organization Control, has been retired by the AICPA.
Do I need SOC 1 or SOC 2?
SOC 1 if the outsourced process affects your financial statements. SOC 2 if the concern is security, availability, confidentiality or privacy.
What is the difference between type 1 and type 2?
Type 1 assesses control design at a point in time. Type 2 assesses operating effectiveness across a period, which auditors generally prefer.
Can I get a provider’s SOC 1 report freely?
Usually not. Access typically requires a non-disclosure agreement, since the report contains detailed control and testing information.
What is a bridge letter?
A provider statement covering the gap between the end of the report period and your own year end. It is an assertion, not an audit.
Which part of the report should I read first?
The exceptions in the testing section. An unqualified opinion at the front can sit above findings that matter to you.
Search verified partners in the Outsource Accelerator directory and ask your own auditor which report they will accept.
Independent
