Financial and transaction processors
Payroll, payments, billing, claims, loan servicing, fund administration: if your output becomes a number in someone’s general ledger, their auditors will ask for your SOC 1.
Certifications & attestations
SOC 1 readiness assessment
A customer’s auditor has asked for your SOC 1 report, because the transactions you process land in their financial statements. Without it, their auditors have to test your controls themselves, and your customer starts asking whether you are worth the trouble. SOC 1 readiness defines your control objectives, closes the gaps and organizes your evidence, so the CPA firm you choose examines a system that is ready for it.
Formal outcome from
A licensed CPA firm you choose
Who asks for it
Customers’ external financial auditors · Customers’ SOX and internal audit teams
Our role
Readiness — we prepare you; your assessor decides
Your organization — readiness viewEvery requirement, an owner and its evidence
Readiness- SCOPEScope and system boundaryReady
- RISKRisk assessment and registerReady
- ACCESSAccess reviews, with evidenceGap · owner set
- CHANGEChange managementClosing
- VENDORVendor managementGap · owner set
- TESTPenetration test evidenceReport in hand
Handed to the assessor you choose — the opinion is theirs
Gaps found before the audit
Who it’s for
Why SOC 1 lands on your desk.
SOC 1 is a report on controls at a service organization that are relevant to user entities’ internal control over financial reporting. It is performed by a licensed CPA firm under SSAE 18, in attestation standard AT-C section 320. If you process payroll, payments, claims, loans, investments, billing or revenue data — or host the systems that do — your customers’ external auditors and SOX teams rely on your controls as part of their own.
Unlike SOC 2, SOC 1 has no fixed list of criteria. You, as management, define the control objectives — that transactions are authorized, complete and accurately recorded, for example, or that access to financial applications is restricted to authorized users — and the controls that achieve them. That flexibility is where first-time teams struggle: objectives that are too broad can’t be tested, and objectives that miss what user auditors need make the report far less useful to the customers who asked for it.
A Type I report covers whether controls are suitably designed and implemented as of a date. A Type II adds whether they operated effectively over a period, which is what user auditors generally need before they rely on your controls. Both reports list complementary user entity controls — the controls your customers must operate for yours to work — and getting those right prevents disputes later.
Who asks for it
Customers’ external financial auditorsCustomers’ SOX and internal audit teamsControllers and CFOs at client companiesBanks, lenders and investors in diligence
SaaS platforms in the financial close
ERP extensions, revenue recognition, expense, procurement and treasury platforms feed customers’ financial reporting. Readiness separates the controls user auditors care about from everything else you run, so the report stays focused.
Hosting and managed IT providers
If you run the infrastructure or applications customers use for financial reporting, your IT general controls become part of their control environment, and their auditors need evidence those controls work.
Companies already holding a SOC 2
Your SOC 2 controls overlap heavily with SOC 1 IT general controls. Readiness reuses that work and adds the business process objectives and transaction controls a SOC 1 needs.
Who certifies
We prepare you. Your assessor decides.
Formal outcome from
A licensed CPA firm you choose
What they produce
SOC 1 Type I or Type II report under SSAE 18 (AT-C section 320)
Where readiness fits
The service auditor must be independent of the controls it examines, so it can’t write your control objectives or build your controls. Readiness does that work with you, so the firm you engage examines a system that is already defined, documented and producing evidence.
AICPA SSAE 18, AT-C section 320 AICPA Guide: Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting (SOC 1) COSO Internal Control — Integrated Framework AICPA AU-C section 402, applied by user auditors
What it covers
What SOC 1 readiness covers.
- Identification of the services and transaction flows relevant to user entities’ financial reporting
- Control objectives that are specific, testable and meaningful to user auditors
- Business process controls over transaction initiation, authorization, recording, processing and reporting
- Reconciliations, interface controls, and the completeness and accuracy of data transfers
- IT general controls over logical access to in-scope applications, databases and operating systems
- Program and infrastructure change management, including segregation of developers from production
- Computer operations: job scheduling, batch monitoring, backup and the handling of processing errors
- Controls over reports and other information your customers rely on for completeness and accuracy
- Complementary user entity controls your customers must operate
- Subservice organizations, the carve-out or inclusive method, and complementary subservice organization controls
- Management’s written assertion and the draft description of the system
- Evidence readiness for the samples a service auditor will select
What you receive
What you have in hand when readiness is done.
Scoping and transaction-flow map
A map of the services, applications and transaction flows that matter to your customers’ financial statements, so the scope stays where user auditors need it and nowhere else.
Control objectives and controls matrix
Draft control objectives with the controls that achieve each one. Every control is written so it can be tested, with an owner, a frequency and the evidence it leaves behind.
Gap assessment
Where controls are missing, informal or undocumented against the objectives, ranked by how much each gap would affect the service auditor’s opinion.
Draft system description
A draft description of your system, for management to own, covering the services provided, the processes and systems behind them, the control objectives and the related controls.
Complementary user entity controls list
A clear, defensible list of the controls your customers must operate, worded so user auditors can test them and your customers understand their side of the arrangement.
Process and ITGC documentation
Narratives and procedures for the business processes and IT general controls in scope, written to how your team actually runs them rather than how a template assumes they run.
Remediation support
Help closing gaps: designing reconciliations and approvals, tightening access and change controls, and organizing evidence before the service auditor begins testing.
Common gaps
What a SOC 1 readiness review tends to surface.
Better found now, by people on your side, than by your assessor.
Control objectives borrowed from another company’s report that don’t match the services actually delivered
Reconciliations performed but not reviewed, or reviewed with no sign-off and date
Developers with standing access to production systems and financial data
Failed batch jobs fixed with no ticket or record of the resolution
Reports customers rely on with no control over their completeness and accuracy
Complementary user entity controls that are vague, missing, or never communicated to customers
No monitoring of subservice organizations whose controls the report carves out
Where testing fits
The tests SOC 1 calls for, from the same team.
Vulnerability assessment
SOC 1 doesn’t require security testing, but access-related control objectives are stronger when you can show vulnerabilities on in-scope systems are found and fixed.
What the test coversWeb application pentest
When customers reach the financial application through the web, testing it supports the objective that access is restricted to authorized users.
What the test coversCloud configuration review
For platforms hosted in a public cloud, it shows the access and change controls over the in-scope environment are configured as described.
What the test covers Questions
What buyers ask about SOC 1.
What is the difference between SOC 1 and SOC 2?
SOC 1 addresses controls relevant to your customers’ financial reporting, and its audience is their auditors. SOC 2 addresses security and the other Trust Services Criteria, and its audience is your customers and their security teams. Many service organizations need both, and readiness for one usually covers much of the IT general control work for the other.
Who defines the control objectives?
You do, as management. The CPA firm evaluates whether the objectives are reasonable for your services and whether your controls achieve them, but it can’t write them for you without impairing its independence. Readiness helps you draft objectives specific enough to test and complete enough that user auditors can rely on them.
Should we get a Type I or a Type II?
A Type I is a point-in-time report on design and implementation, and it can serve as a first deliverable to customers. User auditors who rely on your controls across their fiscal year generally need a Type II covering a period that overlaps their audit. When your report period and a customer’s fiscal year-end don’t line up, expect requests for a bridge letter.
Do we need SOC 1 if we aren’t a financial company?
The test is whether your service affects your customers’ financial statements, not your industry. A healthcare claims processor, a logistics billing platform or an HR system that calculates payroll can all fall in SOC 1 territory. If customers’ auditors are asking, the answer is usually yes.
What are complementary user entity controls?
They are controls your customers must operate for your controls to achieve their objectives — reviewing who in their organization has access to your platform, for example, or reconciling the files they send you. They appear in your report, and user auditors test them on the customer side. Vague or missing ones create disputes, so they deserve real attention during readiness.
Can CyberlySecure issue our SOC 1 report?
No. Only a licensed CPA firm can issue a SOC 1 report, and CyberlySecure is not a CPA firm. We prepare you, and you choose the firm that examines you, which keeps the preparation and the opinion independent of each other.
Is SOC 1 on your desk?
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.