Information security
SOC 1
SOC 1 (System and Organization Controls 1)
SOC 1 is an independent CPA attestation on the controls at your organisation that are relevant to your customers' internal control over financial reporting. We take you from first gap to a clean Type I or Type II report.
What SOC 1 is
SOC 1 is an attestation report produced by an independent CPA firm that describes the controls at a service organisation that could affect its customers' financial statements. It exists so that your customers and their auditors can rely on the controls you run on their behalf when they report on internal control over financial reporting (ICFR).
A Type I report assesses whether the controls are suitably designed at a point in time. A Type II report tests whether those controls operated effectively over a period, usually six to twelve months, and is the one most customer auditors expect when your service is material to their numbers.
The structure of the report
Section 1 · Independent service auditor's opinion
The CPA firm's formal opinion on whether the description is fairly presented and, for a Type II, whether the controls operated effectively.
Section 2 · Management's assertion
A written statement from your management attesting to the accuracy of the system description and the suitability of the controls.
Section 3 · Description of the system
Your narrative of the services, processes, people and technology that make up the system relevant to customers' financial reporting.
Section 4 · Control objectives and controls
The control objectives tied to internal control over financial reporting, with the specific controls that meet each objective and, for a Type II, the auditor's tests and results.
Complementary user entity controls
Controls the report assumes your customers themselves operate for the overall objectives to be achieved at their end.
Type I versus Type II
Type I assesses control design at a point in time, while Type II also tests operating effectiveness across a defined review period.
Who needs it
- Payroll, payments, billing and fund administration providers whose processing feeds customer financials
- SaaS platforms that handle transactions, revenue or financial records for their customers
- Service organisations being asked for a SOC 1 report by a customer's external auditor
What you get
- A gap assessment and prioritised roadmap against the relevant control objectives
- Documented control objectives, controls and an evidence set
- An internal readiness review and dry-run before fieldwork
- Audit preparation and support to a clean Type I or Type II report
Timelines depend on your starting point and whether it is Type I or Type II. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
SOC 1 is an attestation engagement performed under the AICPA's SSAE 18 framework, with AT-C section 320 giving the specific requirements for reporting on controls at a service organisation. SSAE 18 has been the governing standard since it took effect in 2017, consolidating the earlier attestation standards, and AT-C 320 is the current reference point for new reports. There is no separate numbered edition of SOC 1 to adopt; the guidance is maintained by the AICPA and refreshed periodically, so you plan around your chosen Type I date or Type II review period rather than a version changeover.
What it costs
Two costs sit side by side here. tr3labs charges a scoped advisory and implementation fee, quoted up front once we understand your size, your system and how far your controls already are, covering the gap work, control objectives, evidence and readiness. The independent CPA firm that performs the examination and issues the opinion charges separately on its own schedule, since tr3labs is never the auditor and never issues the report. We would rather scope this with you against your real starting point than quote blind.
How tr3labs gets you there
Scope and gap assessment
We identify the control objectives relevant to your customers' financial reporting, map your current controls against them, and hand you a prioritised roadmap to close the gaps.
Build the controls
We help you define the control objectives, implement the process and technical controls that support them, and gather the evidence your auditor will test.
Internal audit and evidence
We run an internal review and dry-run the audit so the controls are operating and evidenced before fieldwork, with no surprises for a Type II period.
Attestation support
We work alongside your CPA auditor through fieldwork to a clean report and keep you ready for the next reporting period.
SOC 1 versus SOC 2
The two share the SOC name and the same attestation machinery, so they are easily mistaken for one another.
| SOC 1 | SOC 2 | |
|---|---|---|
| Covers | Controls relevant to financial reporting | Security, availability, processing integrity, confidentiality, privacy |
| Core idea | Can your customers' auditors rely on you | Can your customers trust how you protect their data |
| Who asks for it | Customers' external financial auditors | Customers' security and procurement teams |
| Measured against | Your own control objectives for ICFR | The Trust Services Criteria |
| Audit model | Type I or Type II, under SSAE 18 | Type I or Type II, under SSAE 18 |
| Typical holder | Payroll, payments and fund administration | SaaS and hosting platforms |
SOC 1 FAQ
- How much does SOC 1 cost?
- Two costs sit side by side: our scoped advisory and implementation fee, quoted up front, and the separate fee the independent CPA firm charges to examine your controls and issue the opinion. tr3labs is never the auditor and never issues the report.
- How long does SOC 1 take?
- It depends on your starting point and whether it is a Type I or Type II report. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- What is the difference between SOC 1 and SOC 2?
- SOC 1 covers controls relevant to your customers' financial reporting, so their auditors can rely on your service. SOC 2 covers security, availability, processing integrity, confidentiality and privacy against the Trust Services Criteria. Which one you need depends on what your customers are asking for.
- What is the difference between SOC 1 Type I and Type II?
- Type I assesses whether your controls are designed correctly at a single point in time. Type II tests whether they operated effectively over a review period, usually six to twelve months, and is what customer auditors usually ask for.
- Who issues the SOC 1 report?
- An independent licensed CPA firm issues the report. tr3labs prepares you for the audit, builds the control objectives and evidence, and supports you through it; we do not issue the attestation ourselves.
Related standards
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read