Each operating company reports that its processing is complete. The shared platform shows no failed jobs. Yet a customer’s month-end report is missing part of the work. Who checks the result across the whole service?
This is a practical SOC 1 problem when several companies help deliver one service. Local checks may work as designed while a gap between teams remains unowned. Management needs a way to connect those checks to the output the customer relies on.
SOC 1 addresses controls relevant to customers’ internal control over financial reporting. The examples here concern that customer service, rather than the group’s own financial consolidation. They illustrate management choices to discuss with the auditor, not required controls for every organization.
Start with the customer output that matters
Choose an output customers use for financial reporting. Establish what your service promises to include, which period it covers, and what checks remain with the customer. Then identify every team whose work contributes to that result.
This is more specific than asking whether each subsidiary follows group policy. A central technology team may keep processing available. Local operations may approve inputs. A shared reporting team may assemble the final file. Each performs a different part of the service.
The AICPA’s AT-C section 320 addresses how the system description explains processing, correction of information and preparation of customer reports. Those connections deserve attention when work crosses organizational boundaries.
When every team’s check passes
Consider an illustrative outsourced billing service. Two operating companies validate customer activity. A shared processing center calculates charges. Another team prepares the customer’s reporting file.
One operating company uses a new service code. Its validation succeeds, but the shared processor rejects those records because its mapping has not been updated. The reporting team checks that its file matches the records the processor accepted. It does. The customer still receives an incomplete result.
The important gap is the rejected work. Who sees it, who decides how to correct it, and who confirms that it reaches the right customer output? A successful job or a balanced comparison against accepted records cannot answer that alone.
In this example, management might arrange a comparison that accounts for submitted records through acceptance, rejection, correction and final output. The exact checks depend on the risks and service. Record counts alone may miss incorrect amounts or customer assignments, so choose comparisons that address the relevant errors.
Assign ownership of the unresolved difference
Give the overall service owner authority to bring the teams together and escalate unresolved issues. That person need not repeat every local check. Their role is to ensure that the process has no unowned handoff.
- Sending team: Knows what was submitted and retains its reference.
- Receiving team: Identifies what was accepted, rejected or held for further action.
- Correction owner: Resolves the problem and links the correction to the original records.
- Output owner: Checks the agreed release conditions and identifies unresolved items affecting the result.
Agree who can make a release decision when a difference remains. Consider the service commitments, impact and available alternatives. If a customer must approve an adjustment or incomplete output, obtain that approval through the agreed process. An internal sign-off does not remove the customer’s rights or reporting needs.
GRC can expose an ownership gap and track the response. Operations must still perform the processing controls. Technology owners must address the system behavior those controls depend on.
Carry corrections through to the customer result
Closing an internal error ticket is only one step. Check what happened to the corrected record. Was it included in a later run? Did a retry create a duplicate? Did it affect the period or version already sent to the customer?
Keep references that connect the original submission, exception, correction and resulting output. If a corrected report replaces an earlier version, make that clear under the customer communication process. Preserve enough history to explain both versions.
These records help management investigate recurring problems. They also let someone reviewing the control understand the work without reconstructing it from separate teams’ inboxes.
Manage local differences and shared changes together
Operating companies may use different source systems or service arrangements. List the differences that affect the customer output. A central processing change may work for one company’s input and fail for another’s.
Before changing a shared mapping or calculation, identify the affected inputs and outputs. Involve the relevant local owners in testing and review. Keep the effective date and results. If part of the group moves later, record which process operated for each part of the period.
Identity and cyber leaders have a supporting role here. Access to change mappings, override exceptions or edit output can affect the processing controls. Decide who needs those privileges and how relevant activity is reviewed. A corporate access policy needs to reach the systems where those actions occur.
Give leadership a useful view
A list of completed local tasks can conceal unresolved customer impact. A concise service-level review can show:
- Differences still unresolved, their age, and the customer outputs they affect.
- Who is responsible, the expected resolution date, and what decision or resource is needed.
- Repeated failures at the same handoff.
- Corrections completed after output was released.
- Changes that could affect other operating companies using the same process.
Set the timing around the service’s processing cycle and risks. There is no universal SOC 1 meeting frequency or dashboard prescribed here. Start with the information management needs to prevent an unresolved difference from becoming a surprise to the customer.
Connect the work to the SOC 1 engagement
Make sure the description and control objectives reflect the actual service and responsibilities. Corporate ownership does not automatically put every operating company or shared service inside one report. Discuss the reporting boundaries and treatment of relevant providers with the auditor.
A group-wide reconciliation may support an objective, but it does not establish that all other relevant controls operated effectively. For help separating the desired outcome from the activities that support it, see choosing SOC 1 control objectives. The broader multinational reporting guide covers how services and report boundaries fit together.
A useful first step is to select one recently corrected item and follow it across the companies involved. Ask each owner to show the next step and its result. Wherever the trail stops, decide who will close the gap.