SOC 1 Report Guide: Scope, SSAE 18, Type 1 vs Type 2

A SOC 1 report helps a customer and its financial statement auditor understand controls at an outsourced service provider. It focuses on controls relevant to the customer’s financial reporting. It is not a general certificate that a company is secure or complies with every regulation.

For example, a payroll provider’s processing controls can affect the payroll amounts in a customer’s accounts. The report needs to cover the service that customer actually uses.

Type 1 or Type 2?

• Type 1: Examines the system description and whether controls are suitably designed as of a specified date.
• Type 2: Also examines whether controls operated effectively over a specified period. It includes the auditor’s tests and results.

Both include management’s description and written assertion alongside the auditor’s report. See AICPA AT-C 320, paragraph .08 for the report definitions.

Start by confirming what your customer and its auditor need. Then use the SOC preparation checklist to organize the work.

Please see the following articles discussing the SSAE 18 guidance and additional information related to the SOC 1 (Type I and Type II) Reports:

• • SSAE 18 Type I Report Background Information
  • SSAE 18, Replacing SSAE 16 starting May 2017
  • SSAE 18 Preparation Tips

Below is a history of key changes made to the audit standard over time to enhance the overall audit and final report.

Differences between SAS 70, SSAE 16 and ISAE 3402:

1. 1. Management of the Service Organization will be required to provide the service auditor with a written assertion about the following, when performing either a Type I or Type II engagement, which the service auditor will then attest to:
      • The fairness of the presentation of the description of the service organization’s system;
      • The suitability of the design of the controls to achieve the related control objectives stated in the description; and
      • The operating effectiveness of those controls to achieve the related control objectives stated in the description (Type II Only)

1. 1. During the process of understanding the service organization’s system, the Service Auditor would be required to obtain information that would identify risks that the description of the service organization’s system is not fairly presented or that the control objectives stated in the description were not achieved due to intentional actions by service organization personnel.

SSAE 18 adds an additional set of requirements to further enhance SSAE 16 standard:

1. 1. Identify complementary subservice organization controls (CSOCs) when they are needed to achieve the report’s control objectives. These are controls the service organization expects its subservice providers to perform. With the carve-out method, those controls are outside the service auditor’s examination. The inclusive method brings the relevant subservice controls into scope. This is not a requirement for a standalone CSOC section in every SOC 1 report. See AICPA AT-C 320, paragraphs .08, .15 and .40.
   2. Management identifies risks to the stated control objectives and designs, implements and documents controls to address them. The service auditor separately assesses the risk of material misstatement and plans responsive examination procedures. These are related but distinct responsibilities (AICPA AT-C 320, paragraphs .10, .22 and .24).

Remember: SSAE 18 replaced SSAE 16 for reports dated on or after May 1, 2017. The report is still called a SOC 1 Report; ISAE 3402 is the corresponding international standard.

The historical changes discussed here help explain report boundaries and responsibilities. For a current examination, use the applicable standards as amended. Check which controls belong to the service provider, its suppliers and the customer.

SOC 2 and SOC 3 – Additional Reporting Options

In addition to the SOC 1 report which is restricted to controls relevant to an audit of a user entity’s financial statements, the SOC 2 and SOC 3 reports have been created to address controls relevant to operations and compliance.

• • SOC 2 Report – Trust Services Criteria – The System and Organization Controls (SOC) 2 examination is performed under AICPA attestation standards, including AT-C section 205, using the applicable Trust Services Criteria. SOC 2 reporting addresses control design (Type I) and, for Type II, operating effectiveness. read more

• SOC 3 Report – General Use – The SOC 3 report also uses the applicable Trust Services Criteria and is performed under AICPA attestation standards, including AT-C section 205. It provides less detail than a SOC 2 report and is intended for general use, so it can be freely distributed. read more