For an outsourced bookkeeping team, the useful question is simple: can customers understand and rely on the controls around the work you do for their financial records? A SOC 1 program should follow that work from receiving source records to completing the agreed close.
Not every bookkeeping business needs a SOC 1 report. It depends on the service and what customers and their auditors need. AICPA describes SOC 1 as addressing controls relevant to customers’ financial reporting. It is not an audit opinion on the customers’ financial statements.
Agree the boundary first
Write down what your team does and what the customer retains. Preparing entries is different from approving them. Preparing a payment file is different from releasing funds.
- Name the services and systems intended for the report.
- Identify the records customers must supply and their deadlines.
- Agree who makes accounting judgments and approves unusual transactions.
- Separate preparation, review and payment authority where those activities apply.
- List important software providers and subcontractors.
Confirm the scope with the CPA firm before building a large control list. The examples below are a practical design starting point. They are not a mandatory checklist for every bookkeeper.
1. Know what came in and what is missing
A bank feed may be working while another account has stopped importing. A shared folder may contain many receipts but still omit a month.
Practical control: The preparer checks that expected source records are available for the client and period. Missing items are tracked and raised before the affected work is marked complete.
Keep: The source-record checklist and follow-up. Identify any work completed with an unresolved limitation. Do not let an empty upload folder look like confirmation that there were no transactions.
2. Check postings and imported transactions
Automated imports save time. They can also introduce duplicates or apply an old coding rule to a new type of transaction.
- Review import results and rejected items.
- Check that the records belong to the correct client and period.
- Investigate unusual classifications or totals.
- Review changes to recurring rules and account mappings before relying on them.
Keep: Import checks, correction records and approved rule changes. A completed import message does not establish that every expected record was posted correctly.
3. Reconcile and resolve differences
Assign reconciliations to the relevant accounts. Define what the reviewer checks and how unresolved differences are handled.
Practical control: A reviewer checks the reconciliation and follows up on unexplained differences before the agreed close is released. Any accepted outstanding item has a reason and an owner.
Keep: The reconciliation, review result and follow-up. A sign-off without a visible review trail may leave important questions unanswered.
For a very small team, consider a competent reviewer outside the preparation role. That might be an appropriate customer reviewer or another qualified person. Make the arrangement explicit and assess whether it addresses the risk. Do not describe self-review as independent review.
4. Control adjustments and the close
Late entries can change a report the customer already received. Treat them as changes that need visibility, not quiet edits to the final workbook.
- Support adjustments with an explanation and relevant records.
- Obtain the approval required by your agreed process.
- Identify the reporting period affected.
- Control reopening of a closed period.
- Tell the customer when previously issued outputs have changed.
Keep: Adjustment support and approval, along with the revised output where relevant. Record which version was delivered. Avoid using “final” as a substitute for a clear version history.
5. Make customer review a real handoff
The customer may retain responsibility for approving estimates or confirming business transactions. Tell them exactly what you need and when.
Do not state that the customer reviews every close if your team only sends a report and assumes silence means approval. Use a process that matches the agreed responsibility.
Keep: The request and response. Track unresolved questions. Where a report relies on customer controls, those responsibilities need to be understood rather than hidden in a document.
6. Protect the systems behind the work
The accounting process depends on more than spreadsheets. Access to client ledgers and configuration changes can affect financial records.
- Use named accounts and limit access to assigned work.
- Remove access when staff or client assignments change.
- Protect devices and credentials used for client work.
- Review important software dependencies and their service limitations.
- Plan how records and essential work can be recovered after an outage.
Keep: Access decisions, changes and relevant recovery results. Protect the evidence itself. A folder containing every client’s records should not be open to the whole team by default.
Keep the program manageable
Give each recurring control an owner and a backup. Tie its timing to the work, such as an import or monthly close. Use existing work records where they already show what was done.
The team lead should review late tasks and repeated errors. Decide whether the process needs fixing rather than repeatedly closing the same issue.
Management is responsible for defining the relevant control objectives and operating the controls. AICPA AT-C section 320 sets out the SOC 1 reporting framework. A Type 2 examination includes operating effectiveness over the specified period. It needs more than recently written procedures.
A useful first step
Walk through one completed client month with the person who prepared it and the person who reviewed it. Follow a source record into the ledger and through the reconciliation. Then check an adjustment and the final delivery.
Look for missing ownership or evidence. Fix the pattern across the affected clients instead of producing a perfect demonstration for only one file.
For file-sharing detail, see checking a client workbook before sending it. If payroll is your main service, use the separate small payroll provider SOC 1 guide.