What is a SOC 1 Report?
by Sarah Harvey / June 21st, 2019
What is a SOC 1 Report?
Once you’ve made it through the evidence gathering portion of the SOC 1 audit process, our specialized team of professional writers will take the information gathered by our auditors and provided by you in our Online Audit Manager to create a final SOC 1 report. What is a SOC 1 report? It is a report that is based on the Statement on Standards for Attestation Engagements Number 18, Section 320 (SSAE 18) and reports on the effectiveness of your internal controls that may be relevant to your client’s internal controls over financial reporting (ICFR). What’s included in this report? How do you use a SOC 1 report? Let’s find out.
What’s Included in Your SOC 1 Report?
When you’ve finished your SOC 1 audit, you’ll receive a SOC 1 report that begins with an opinion letter that’s issued by an independent certified public accountant. This opinion letter will include the following:
- The scope of the engagement
- What the service organization’s responsibilities were
- An opinion on the design of the controls
- The description of the controls that management provided
- An opinion on whether or not the controls were in place and operating effectively
- The auditor’s final opinion on the effectiveness of an organization’s internal controls
In addition to the opinion letter, the report will also include a description of the tests conducted throughout the audit as well as an analysis of exceptions to the effectiveness of internal controls.
How Do You Use a SOC 1 Report?
Once you’ve received your SOC 1 report, you might wonder how you can actually use your report. If you pursued SOC 1 compliance because a client requested it, you’ll provide this audit report to their auditors for review. If you proactively pursued SOC 1 compliance without being asked for it, there’s many ways to leverage your compliance efforts to give your organization a competitive advantage.
Want to learn more about how we can help you get started on your SOC 1 compliance journey? Contact us today.
More SOC 1 Resources
Understanding Your SOC 1 Report Video Series
SOC 1 Compliance Checklist: Are You Prepared for an Audit?
How to Read Your Vendors SOC 1 or SOC 2 Report?
What is a SOC 1 report? A SOC 1 report is an audit that is specifically designed for service organizations. It’s based on a Statement on Standards for Attestation Engagements, and in this case, SSAE No. 18. Section 320. The way the report is formatted is that it starts out with an opinion letter. The opinion has to be issued by an independent certified public accountant. An auditor that is independent from the service organization issues an opinion that covers what the scope was of the engagement, it talks about what the service organization’s responsibilities were, it talks about what the service auditor’s responsibilities were, and ultimately, it provides an opinion on the design of the controls, the description that management provided, whether or not the controls were in place and operating effectively over a period of time for a Type II report, and what the auditor’s opinion was after conducting all of the testing and the examination. Once you have the report in hand, the service organization can hand that to their clients, which are known as user organizations. User organizations rely upon that report usually in the course of their own audit as they are concerned with internal control over financial reporting. You should look for a qualified, independent CPA who has particular expertise in performing SOC 1 engagements.
