The report your customers\u2019 auditors ask for when your service affects their financial statements. Different question from SOC 2, and frequently needed alongside it.
What is SOC 1?
A SOC 1 report is an attestation, performed under SSAE 18 and AT-C 320, on the controls at a service organisation that are relevant to its customers\u2019 internal control over financial reporting. If what you do feeds your customers\u2019 numbers, their external auditors need assurance over your controls in order to sign off their accounts, and SOC 1 is how they get it.
It is often confused with SOC 2, and the distinction is about audience rather than rigour. SOC 2 answers a security question and is asked for by security and procurement teams. SOC 1 answers a financial reporting question and is asked for by finance teams and external auditors. Payroll providers, payment processors, claims administrators, benefits administrators and parts of fintech frequently need both, for different people at the same customer.
Type 1 and Type 2 exist inside SOC 1 just as they do inside SOC 2. A Type 1 reports on control design at a point in time. A Type 2 covers a period, normally six to twelve months, and tests whether the controls actually operated. Auditors almost always want Type 2, because a point-in-time report tells them nothing about the year they are auditing.
Compliance requirements
Control objectives are defined by you rather than prescribed, which is what makes scoping the hardest part.
You define the control objectives relevant to your customers’ financial reporting and describe the system. Management asserts this is accurate, and the auditor tests it.
Completeness, accuracy, authorisation and timeliness of the transactions you process on a customer’s behalf.
Who can reach the systems and data that affect financial reporting, how that access is granted, reviewed and removed.
Changes to the relevant applications and infrastructure authorised, tested and approved, evidenced across the whole period.
The ITGC layer beneath everything else: job scheduling, backup, and the operational controls the transaction controls depend on.
The controls your customers must operate at their end for your objectives to be met. Stating these clearly prevents an argument later.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We work out which of your services actually touch customer financial reporting and draft control objectives that are defensible without being unnecessarily broad.
We confirm what your customers’ auditors will accept, and set the observation period backwards from their year end rather than from yours.
We assess your current controls against the drafted objectives and produce a remediation plan before the auditor is engaged.
Your compliance manager writes the system description that management will assert to, which is the document the report is built around.
We put the evidence generation in place for the observation period, because a Type 2 tests the whole period rather than the week before fieldwork.
We manage the CPA firm through fieldwork and handle requests, findings and the path to a clean opinion.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone