What is SOC 1?
The CPA-attested report your financial services clients require
SOC 1 (Service Organization Control 1) is a CPA-attested report governed by SSAE 18 (AT-C Section 320) that evaluates controls at a service organization relevant to user entities' internal control over financial reporting (ICFR).
Unlike SOC 2, which covers security and trust, SOC 1 is specifically about financial controls — the systems and processes that affect your clients' ability to produce accurate financial statements. Your clients' external auditors use your SOC 1 report to assess whether they can rely on your controls.
If you process payroll, handle payments, service loans, or manage financial data on behalf of clients, their auditors will ask for your SOC 1 report. Without it, they cannot place reliance on your controls — creating an audit roadblock for everyone involved.
SOC 1 Unlocks Enterprise Contracts
SOC Type 1 vs Type 2
Scoping & Readiness
Week 1-3Control Design
Week 3 - 6Control Implementation
Month 3 - 7Observation Period
Month 2-8CPA Testing
Month 8 - 10Reports Issued
Month 10 - 12What's blocking organisations from getting their
SOC 1 report
HOW WE DELIVER CERTIFICATION
From scoping to CPA-attested report — the full delivery
journey
Scope & plan
Define ICFR scope, identify material services, and plan the engagement
Readiness assessment
Gap assessment of existing ICFR controls against SSAE 18 requirements
Control design & evidence
Design, document controls and build the evidence collection programme
CPA coordination
Manage CPA firm relationship, testing support, and exception response
Report & annual cycle
SOC 1 Type ll report issued and annual renewal programme established
Inside a SOC 1 Type Il report — what your clients’ auditors read
SOC1 Type 2 Report (SSAE 18)
WHAT'S INCLUDED — The full scope of our
SOC 1 programme
Strategic SOC 1 scope & plan
Precise identification of which services materially affect client ICFR — scoped to avoid over-auditing and reduce cost, with CPA scope agreement from day one.
SOC 1 readiness assessment
Gap assessment of your existing ICFR controls against SSAE 18 requirements — identifying control gaps and missing evidence before any CPA is involved.
ICFR control design & documentation
Design of control objectives, written control descriptions, and operating procedures aligned to your specific financial services scope — written to pass CPA testing.
Evidence collection programme
Design and implementation of the evidence collection process — ensuring every control generates the right type and volume of evidence for CPA testing over the observation period.
CPA coordination & audit support
End-to-end management of the CPA firm relationship — from firm selection through audit fieldwork, exception response, and report finalisation. On-site presence during CPA testing.
HOW WE GET STARTED
From first call to CPA-attested report — in four steps
1
Scope definition & readiness
We define your ICFR scope precisely, gap-assess existing controls, and deliver a written readiness report within 2 weeks
2
Control design & documentation
CFR controls designed, documented, and operating procedures written — ready for CPA agreement before the observation period starts
3
Observation period & evidence
Controls operate and evidence is collected throughout the observation period — we manage collection and review before CPA testing begins
4
CPA audit & report
CPA firm coordinated, audit supported on-site, exceptions resolved, and SOC 1 Type II report issued — with annual renewal established
BUSINESS OUTCOMES — What our customers achieve
0
First-time audit failures across all SOC 1 engagements
12–16 wk
Typical readiness to Type II report delivery
SSAE 18
Certified practitioners on every engagement — no generalist consultants
Annual
Renewal programme keeps report current for client auditors
Enterprise deals unblocked
SOC 1 Type II report removes the single biggest compliance barrier in enterprise financial services procurement — deals that were stalled move forward
CUECs documented
Complementary User Entity Controls formally identified and communicated to clients — completing the control environment and protecting you from audit exceptions