Key Facts
- Regulator
- AICPA & CIMA (the Association of International Certified Professional Accountants, founded by the American Institute of CPAs and The Chartered Institute of Management Accountants)
- Latest version
- AICPA Guide 'Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1®)', 2025 edition, for SOC 1 examinations under AT-C section 320.
- Official text
- www.aicpa-cima.com ↗
What is SOC 1?
SOC 1 is an examination of controls at a service organisation that are likely to be relevant to its customers' internal control over financial reporting. AICPA & CIMA publish the guidance, and CPAs perform the engagements. It applies to service organisations whose controls affect their customers' financial reporting.
SOC stands for System and Organization Controls. It is a suite of services that CPAs may provide on a service organisation's system-level controls, and SOC 1 sits alongside SOC 2, SOC 3, SOC for Cybersecurity and SOC for Supply Chain. The publisher is AICPA & CIMA, the Association of International Certified Professional Accountants.
The current guide is Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1®), which is in its 2025 edition. The AICPA publishes it for CPAs performing SOC 1 examinations under AT-C section 320.
SOC reports are assurance reports. They give the people who rely on an outsourced service the information they need to assess and address the risks of outsourcing it.
Why it matters
The customer's auditor asks for your SOC 1 report. You don't have one. Their year-end is waiting on you.
A SOC 1 audit exists for a narrow reason. The auditor of a customer's financial statements (the user auditor) has to evaluate the effect of your controls on those statements. An independent CPA's examination gives that auditor something to rely on.
A SOC 1 report is evidence for someone else's auditor, not a badge for your website.
Who it applies to
SOC 1 applies to service organisations whose controls are likely to be relevant to their customers' internal control over financial reporting (ICFR). The readers of the report are those customers (user entities) and their user auditors.
It usually does not apply to a service organisation whose work has no bearing on a customer's financial statements. A user auditor has nothing to evaluate in that case.
Obligation. The AICPA describes SOC engagements as services CPAs "may provide", and we found no source that makes SOC 1 mandatory. It is voluntary for the service organisation in the first instance. It becomes a contractual expectation when a customer or its auditor asks for the report.
SOC 1 and SOC 2. The two are separate services in the same AICPA suite, and a customer's request normally names one or the other. The SOC 2 entry covers the second.
SOC 1 and ISO 27001. ISO 27001 certifies an information security management system. SOC 1 is a CPA's examination of controls relevant to a customer's financial reporting, so holding one does not answer a request for the other.
An ISO 27001 certificate answers a security question. A SOC 1 report answers an audit question.
The UK position
SOC 1 is a US-originated service, and no UK law requires it. A UK firm meets it mainly when a US customer, or that customer's auditor, asks for one. UK service organisations can offer an AAF 01/20 or ISAE 3402 report in that situation, and the customer decides whether it accepts one in place of SOC 1.
| Regime | Who it affects | What it is |
|---|---|---|
| ICAEW AAF 01/20 | UK service organisations making assurance reports on their internal controls available to third parties | The UK counterpart to SOC 1 for assurance reports on a service organisation's internal controls |
| ISAE 3402 and ISAE (UK) 3000 | Service organisations and their auditors working to international or UK assurance standards | ISAE 3402 is the international standard for service organisation controls reports relevant to financial reporting. It expands on ISAE 3000 (Revised) |
Key requirements
The AICPA's SOC 1 guide is a paid publication, so this section describes the structure at the level of the public AICPA pages. It does not reproduce the guide.
A SOC 1 engagement rests on five points:
- Scope is financial reporting. The examination covers controls at the service organisation that are likely to be relevant to user entities' ICFR. Controls with no bearing on customers' financial reporting fall outside it.
- A CPA performs it. The service auditor, an independent CPA, performs the examination under AT-C section 320. The report does not come from the service organisation itself.
- The audience is defined. The report is intended for user entities and for the auditors of their financial statements.
- The purpose is evaluation. User auditors use the report to evaluate the effect of the service organisation's controls on the user entities' financial statements.
- The guide sets the reporting rules. The AICPA's SOC 1 guide (2025 edition) covers planning and performing the engagement, how a user auditor uses a type 1 or type 2 report, and reporting on it. Its detail is for the service auditor to apply.
For the wider suite, including SOC 2 and SOC 3, see the AICPA's SOC overview.
Frequently asked questions
SOC stands for System and Organization Controls, the AICPA's name for a suite of services CPAs may provide on a service organisation's controls. SOC 1 is the member of that suite that examines controls relevant to user entities' internal control over financial reporting. The number distinguishes it from SOC 2, SOC 3 and the other offerings.
A SOC audit is an engagement in which a CPA examines a service organisation's controls and issues an assurance report. SOC 1 is the version aimed at controls relevant to customers' financial reporting, and the CPA who performs it is known as the service auditor.
SOC 1 concerns controls relevant to user entities' internal control over financial reporting. SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality or privacy, as the title of the AICPA's SOC 2 guide sets out. Which one you need depends on what your customer or its auditor asks for.
The AICPA's 2025 SOC 1 guide covers both type 1 and type 2 reports and how a user auditor uses each. The AICPA's public pages do not define the difference, and the guide is a paid publication. Confirm the definitions with the CPA firm performing your SOC 1 engagement before you agree a scope with a customer.
A UK firm meets SOC 1 mainly when a US customer, or its auditor, asks for it. UK service organisations can offer an ICAEW AAF 01/20 or ISAE 3402 report in that situation. Whether the customer accepts one in place of SOC 1 is for the customer and its auditor to decide.