Corrected October 30, 2026. The original publication date is retained.
SSAE No. 18 recodified U.S. attestation standards and superseded SSAE 16. It became effective for reports dated on or after May 1, 2017. This is historical transition information; use the applicable standards as amended when planning an engagement today.
The change did not make every SOC report a SOC 1 report. It also did not expand SOC 1 into a report on every outsourced service or every compliance obligation. The AICPA SSAE 18 resource describes the recodification.
What Does SOC 1 Cover?
SOC 1 addresses controls at a service organization relevant to user entities’ internal control over financial reporting. Whether it is appropriate depends on the services performed and their effect on customers’ financial reporting, not simply the industry name.
Example Scenario: A payroll processor’s controls may affect payroll amounts in customer financial statements. A hosted collaboration service may instead receive requests for SOC 2 assurance about its system controls. The requested report should follow the customer’s actual need.
Keep the Standards and Report Types Separate
Attestation standards address different engagement types and subject matters. SOC 1 has its own financial-reporting-control purpose. SOC 2 addresses controls relevant to applicable Trust Services Criteria. Other examination, review or agreed-upon procedures engagements should not be described as expanded SOC 1 coverage merely because they use attestation standards.
The AICPA SOC resource library provides resources for distinguishing the report types.
What Should a Service Organization Prepare?
- Define the services and system proposed for the examination.
- Identify the relevant risks, control objectives or criteria, and controls.
- Assign management owners who can explain how the controls operate.
- Understand subservice organizations and how their activities affect the service.
- Retain evidence and discuss changes, gaps and scope questions with the CPA firm.
These planning steps should be tailored to the engagement. They do not establish one universal vendor program, annual assessment schedule, report price or set of additional report sections for every organization.
How Do You Start?
Confirm what the intended report users need, then compare proposals for the same scope and timing. Ask what work is included, what management must provide, and what changes could affect fees. Our SOC preparation checklist provides a practical starting point.