SOC 1 (Service Organization Controls 1) is the AICPA audit report on a service organization's controls that are relevant to its customers' Internal Control over Financial Reporting (ICFR). It is performed under SSAE 18, AT-C 320, and is read by the customer's financial-statement auditors, not by their security team.
What does a SOC 1 actually test?
SOC 1 tests control objectives a vendor defines around processes that touch a customer's general ledger, payroll, billing, or financial data.
The standard reference is AT-C 320 under SSAE 18, distinct from the SOC 2 basis of AT-C 105 plus AT-C 205 (AICPA SSAE summary). SSAE 21, effective for reports dated on or after June 15, 2022, did not change the SOC 1 standard. Typical control objectives cover transaction completeness, authorization, calculation accuracy, change management around the financial-reporting application, and access provisioning to the production GL.
How is SOC 1 different from SOC 2?
SOC 1 is a financial-controls audit. SOC 2 is a security-and-trust audit. The two reports have different audiences and different attestation rules.
| Dimension | SOC 1 | SOC 2 | | --------------- | -------------------------------------- | ------------------------------------- | | Focus | ICFR | Trust Services Criteria | | Standard | AT-C 320 | AT-C 105 + AT-C 205 | | Audience | Customer's financial auditors | Customer's security/vendor risk teams | | Criteria source | Service org defines control objectives | AICPA fixes the five TSC |
Who actually asks for a SOC 1?
Payroll providers, billing platforms, claims processors, and fund administrators get asked because their customers' SOX auditors test them.
Most pure SaaS companies never need a SOC 1 even though they reach for one defensively. The AICPA SOC suite page lists SOC 1 as one of three reports; we see teams over-order SOC 1 audits when no customer's external auditor has actually requested it. Those dollars are usually better spent on the SOC 2 Type 2 that buyers do ask for in TPRM review.
Related terms
These adjacent reports and standards travel with SOC 1, and a buyer's questionnaire will often ask for several of them at once before settling.
- SOC 2 - the security/availability counterpart for Trust Services Criteria, not financial reporting
- SOC 3 - the publishable general-use summary of a SOC 2 examination
- TPRM - the vendor-review motion that decides which SOC report a buyer wants
- SIG - the questionnaire that asks whether you have a SOC 1, a SOC 2, or both