Definition

SOC 1

SOC 1 is an attestation report that describes the controls at a service organization that could affect its customers' financial statements. Payroll processors, claims administrators, and loan servicers commonly need one because their work flows straight into a client's books. Under the SSAE 18 standard, a CPA firm tests whether those controls are designed well and, in a Type II engagement, whether they operated over a period. A client's own auditors then rely on the report instead of re-testing the same processes. SOC 1 centers on financial reporting risk, which sets it apart from the security focus of SOC 2.