Design at a point in time
Description and control design as of one date. Says nothing about operation over time.
Financial reporting controls
SOC 1 readiness for controls your customers’ auditors rely on.
We prepare service organizations for SOC 1: control objectives, system description, evidence and the auditor relationship. The result is a report your customers’ auditors accept without a second round of questions.
- SSAE 18 · AT-C 320
- ISAE 3402
- Type 1 & Type 2
- Who it is for
- Payroll, payments, fund administration, billing and hosted financial platforms
- Report readers
- Customers’ management and their external auditors
- Our role
- Readiness, control design, evidence and audit management
- The outcome
- A clean report your customers’ auditors can rely on
The business challenge
A report written for someone else’s audit.
A SOC 1 lets your customers’ auditors rely on your controls instead of testing them. Done well, a year of questionnaires and audit visits collapses into one document.
Done badly, it fails late: untestable objectives, unknown CUECs, a carve-out nobody checked. We fix all of that before the auditor arrives.
- Type 1: design at a point in time
- 1 date
- Type 2: operation over a period
- 6–12 months
- Report replaces many user-auditor requests
- 1 report
Client outcomes
What a well-prepared SOC 1 changes.
01
Testable objectives
Tied to the transactions and assertions user auditors care about.
02
A description that holds
Boundaries, subservice organizations and CUECs stated accurately.
03
A clean Type 2 period
Controls dry-run and evidenced before the period starts.
04
Fewer audit requests
One independent report instead of yearly questionnaires and visits.
How SOC 1 works
Six mechanics that decide the report.
Performed under AICPA SSAE 18 (AT-C 320); ISAE 3402 is the international counterpart.
Operation over a period
Tests that controls worked throughout six to twelve months, what user auditors want.
Objectives are management’s
No prescribed criteria. That freedom is the main source of weak reports.
Customer controls
Controls your customers must operate for your objectives to be achieved.
Subservice providers
Carved out (described, not tested) or included (tested, with their cooperation).
Gaps between periods
Management letters cover the gap to customers’ year-ends. They are not audit evidence.
Interactive explorer
Who operates which control?
Pick a control objective, then switch between carve-out and inclusive to see what your auditor actually tests.
Illustrative objectives. Yours are set by management and tailored to your service.
Our methodology
Scoping call to audit-ready.
Five stages, each with a fixed output. When fieldwork starts, your auditor meets a system that has already been tested.
- Discover
Define the system
Services, transactions and customer reliance in scope.
- Assess
Objectives & gaps
Draft objectives, map controls, find design and evidence gaps.
- Remediate
Design & dry-run
Controls, description, CUECs and subservice method.
- Validate
Readiness test
Sample-test as an auditor would; agree type and period.
- Sustain
Period & renewal
Evidence through the period, bridge letters, next cycle.
To an auditor, an undocumented control did not operate.
We build evidence capture into the control, not around it.
Deliverables
What you keep.
Control objective & control matrix
Objectives, controls, owners, frequency, evidence and assertions.
System description
Draft of management’s description: boundaries, subservice organizations, CUECs.
Readiness report
Gaps by objective, with a remediation plan, owners and dates.
Evidence calendar
Every control occurrence through the period, with evidence locations.
CUEC customer guide
Plain-language guidance customers receive before their auditors ask.
Audit management pack
CPA firm selection criteria, RFP pack and fieldwork logistics.
Accreditation & scope
From readiness to a signed report
What MarkTillson delivers
- Readiness assessment and gap analysis
- Control design, documentation and evidence preparation
- Drafting support for management’s system description
- Auditor selection and management of fieldwork
What completes the report
- The SOC 1 examination and opinion, signed by the licensed CPA firm you appoint (or under ISAE 3402 by a qualified practitioner)
- Management’s written assertion, signed by your leadership
Framework mapping
Where SOC 1 controls overlap.
IT general controls often serve other frameworks. SOC 1 remains about financial reporting reliance.
| Control area | SOC 1 | SOC 2 (Security) | ISO/IEC 27001 | SOX ITGC (client side) |
|---|---|---|---|---|
| Logical access provisioning & review | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Change management for in-scope applications | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Batch & interface processing completeness | Directly addressed | Partially addressed | Not addressed– | Directly addressed |
| Transaction authorization & reconciliation | Directly addressed | Not addressed– | Not addressed– | Directly addressed |
| Backup & recovery of financial data | Partially addressed | Directly addressed | Directly addressed | Partially addressed |
| Vendor / subservice oversight | Directly addressed | Directly addressed | Directly addressed | Partially addressed |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. Business-process controls are specific to SOC 1.
Industry considerations
Same standard, different pressures.
Settlement, fee calculation and reconciliation flow straight into merchants’ and banks’ ledgers. Where cardholder data is in scope, one access review can serve both SOC 1 and PCI DSS.
NAV, pricing and transfer agency are classic SOC 1 territory. International investors often expect ISAE 3402, decide with your auditor before scoping.
User auditors focus on master-data and rate changes and output reconciliation. Design the period to include year-end and tax changes, when controls fail.
Billing and revenue platforms are asked for SOC 1 and SOC 2. Customer-specific rule configuration is often the hardest change control to evidence.
Technical risks
Where readiness usually breaks.
Unmonitored file transfers
No completeness checks, so a dropped batch surfaces only when a customer reconciles.
Shared production credentials
Service accounts without individual accountability make access testing impossible.
Configuration outside change control
Pricing tables and rule engines edited through admin consoles.
Carve-out without diligence
A hyperscaler report whose scope or period does not cover your reliance.
Engagement journey
What you hold at each step.
-
01
Scoping
Services, customers and report type agreed.
OutputScope memo
-
02
Readiness
Objectives drafted, gaps found.
OutputReadiness report
-
03
Remediation
Controls and description built.
OutputDraft description
-
04
Pre-audit
Controls sample-tested.
OutputPre-audit results
-
05
Examination
Your CPA firm performs fieldwork, with us at your side.
OutputSigned SOC 1 report
FAQ
Questions finance teams ask.
Do we need SOC 1 or SOC 2?
Ask who reads the report. Customers’ financial auditors need SOC 1; customers wanting security assurance need SOC 2. Many FinTech providers need both and share much of the evidence.
Who signs the SOC 1 report?
A licensed CPA firm signs the opinion. We get you ready, help you appoint the firm and manage fieldwork with you until the report is issued.
Type 1 or Type 2 first?
A Type 1 confirms design quickly. User auditors relying on a fiscal year want a Type 2, so a common path is Type 1, then a Type 2 period.
Do we need ISAE 3402 as well?
Ask your non-US customers and their auditors. Many firms can issue one report under both standards; decide before fieldwork.
What about our cloud provider’s controls?
They are usually carved out and covered by the provider’s own SOC report. We check that its scope, services and period actually cover your reliance.
Related
Related services and insights.
Speak with an expert
Make your next audit season uneventful.
Tell us about your service, your customers and their year-ends. A senior practitioner will recommend the report type, the period and the fastest route to a clean opinion.