SOC 1 is relevant when a service organization’s controls affect its customers’ internal control over financial reporting. Examples may include outsourced payroll or claims processing. Customers and their financial statement auditors may request the report to understand those controls. Handling financial transactions alone does not mean every organization needs a SOC 1 report.
SSAE No. 18, Attestation Standards: Clarification and Recodification, clarified and recodified the AICPA attestation standards. It superseded SSAE No. 16 and other earlier standards, with specified exceptions. It covered more than SOC 1: the resulting AT-C sections address different kinds of attestation engagements. SOC 1 examinations concern controls at service organizations relevant to user entities’ internal control over financial reporting and use AT-C section 320 together with applicable general and examination requirements. For a current engagement, consult the applicable AT-C standards as amended, rather than treating SSAE 18 as an unchanged standalone SOC 1 framework.
Choose based on the assurance your customers need. SOC 1 addresses controls relevant to customers’ internal control over financial reporting. HITRUST offers cybersecurity assessments and certifications with different scopes and levels of assurance. A third-party administrator processing medical claims may be asked for both: one for financial-reporting controls and the other for information protection. Confirm the requested HITRUST assessment, covered systems, and contractual requirements rather than assuming every claims processor needs both. Neither deliverable automatically substitutes for the other.
There is no fixed completion time. Estimate three parts: getting controls and evidence ready, the period a Type 2 report will cover, and the auditor’s fieldwork and report review. Some work can overlap, but a Type 2 report cannot cover a period that has not finished. Ask the CPA firm for three milestones: controls ready, reporting period end, and expected report delivery. A Type 1 report addresses a date rather than a period, but still needs preparation and examination work.
SOC 1 asks whether a service organization’s controls support reliable financial reporting by its customers. For example, a payroll provider’s processing can affect a customer’s payroll expense figures. SOC 2 asks about controls over the service system, such as protecting data or meeting availability commitments, within the categories examined. A hosted application may therefore be asked for SOC 2 even when it does not feed financial statements. The same provider can need both: the deciding factor is the customer’s assurance question, not the provider’s industry label.
Review outsourced services that can affect the in-scope system or controls. The extent of review should reflect the service and its risks. Where a vendor supplies an assurance report, assess its scope, coverage period, findings, and responsibilities assigned to your organization; collecting the report alone is not enough. Discuss with your auditor which suppliers and subservice organizations matter to the engagement and retain evidence of your review and follow-up.
SOC Reporting Guide
Ask about the subcontractors and other dependencies that could affect your service, and how your vendor oversees them.
Historical SSAE 16 and ISAE 3402 context, corrected disclaimer claims, and practical questions for choosing current service-organization reporting.
Start with the service your organization depends on, then connect review findings to decisions, ongoing oversight and an exit plan.
Understand what SSAE 22 changed in limited-assurance reviews and why it is not a wholesale replacement of SOC 1 or SOC 2 examination requirements.
Discuss the report type, service scope, coverage and delivery terms needed in a contract rather than relying only on an old standard number.
Define external and internal network assessment boundaries, starting access, coverage, operational safeguards and retest evidence.
Copyright 2026 © All rights Reserved.