What is SOC 1 Compliance?

SOC 1 (System and Organization Controls 1) is one of the standards established by the AICPA. It describes the audit work related to the service SaaS organization’s financial reporting internal controls (ICFR). It generates a report that can serve as a basis of reliance for the SaaS company’s clients and their auditors in assessing the reliability of the financial statements. 

For a service business that works on a variety of financial services like payment processing, payroll, billing and related support for the clients, SOC 1 is most of the times the deciding factor when it comes to getting a client to sign a contract, the report tells the client that outsourcing the financial task to a third-party provider is not going to add a third-party financial risk to their own financial records.

Type 1 report checks whether controls are adequate from the client’s perspective at a single point in time; Type 2 is a more comprehensive examination of the actual operation of controls over several review periods (from six to twelve months). The majority of clients and auditors choose Type 2 as it provides a clearer picture of the consistent effectiveness of controls than a momentary view.

Financial reporting is the main subject of controls under SOC 1; SOC 2 assesses controls for non-financial items such as security, availability, confidentiality, privacy, etc., and processing integrity. 

SOX 404 is the legal requirement of US-listed companies to review their own internal controls. However, SOC 1 is a voluntary SOC report prepared by the service organization for use by its clients. A payment organization that serves public companies and handles data might be required to show all three reports.

The process of preparing usually goes from identifying the systems and processes in financial statements, to preparing documentation covering control activities, performing an assessment or gap analysis, rectifying deficiencies, and finally hiring a registered audit practice for the actual audit.

CUECs are controls that the client SaaS organization must maintain for the overall control environment to function as intended; the service organization can’t cover everything. In some cases, a payment platform’s process involves clients reviewing and approving settlement reports, an activity that the platform cannot directly mandate. Auditors document CUECs so both parties understand where responsibility sits.

Costs vary widely based on company size, number of controls in scope, and whether it’s a Type 1 or Type 2 report, but audits commonly range from $15,000 to $100,000+ annually, plus internal staff time for preparation. Type 2 audits and more extensive control environments are often accompanied by higher financial outlays.

Consider the following two questions if you are a service provider:

1.   Do my offerings impact the client’s financial statements?
2.   Is this report an item on a prospective or current client’s procurement checklist?

If one of the above conditions is met, SOC 1 compliance could be a contributing factor.