Financial Reporting Controls (SOC 1)

SOC 1 is an independent assurance report on a service organisation's internal controls that affect its customers' FINANCIAL REPORTING. It is not a certificate: it is a report issued by a licensed independent auditor and contains the auditor's opinion. Its primary user is the customer's own accountant or independent auditor.

• Companies providing payroll and accounting services
• Payment processing and collection service providers
• Asset management and custody service providers
• SaaS providers processing their customers' financial data
• Service organisations receiving a report request from their customer's independent auditor

Not mandatory; it is requested when the customer's independent audit process requires it. For organisations serving publicly listed companies, it effectively becomes a requirement because of the customer's auditor's request.

• System description: the scope of the service, processes, infrastructure, personnel and data flow
• Setting control objectives (related to financial reporting)
• Defining control activities
• Type I — the suitability of the design of controls at a specific date
• Type II — the operating effectiveness of controls over a specific period
• Complementary user entity controls (CUEC)
• Treatment of subservice organisations: the inclusive or carve-out method
• The auditor's opinion and test results

1. 1Determining Scope and ProgrammeThe sites and processes to be audited, and the audit duration the scheme requires, are determined.
2. 2Pre-assessmentA gap analysis is optionally carried out; gaps become visible before the main audit.
3. 3On-site AuditRecords review, site observation and worker interviews are carried out against the scheme's checklist.
4. 4Reporting of FindingsFindings are reported according to the scheme's classification. The output of these schemes is an audit report, not a certificate.
5. 5Corrective Action and Follow-upA corrective action plan is submitted for the findings; it is closed with a follow-up audit under the scheme.

The validity period of audit reports is set by the scheme and is mostly between one and two years. The report is used for the period the buying brand accepts.

• Organisation and site details
• Headcount and shift pattern
• Legal permits and licences
• Relevant policies and procedures
• Payroll, time and personnel records

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The number of sites to be audited and the headcount
• The audit duration the scheme prescribes
• Whether a pre-assessment (gap analysis) is requested
• Whether a follow-up audit is required

Most of these schemes produce audit reports, not documents, and are subject to the scheme owner's (e.g. Sedex, amfori, RBA) own approval system; Accreditation in the classical sense is not found in every scheme. Auditor competence and report validity are determined by the scheme owner's rules.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• SOC 2Service Organization Trust Controls
• PCI DSSPayment Card Data Security
• TISAXAutomotive Information Security Assessment
• ISO/IEC 27001Information Security Management
• ISO/IEC 27017Cloud Security
• ISO/IEC 27018Personal Data in the Cloud
• ISO/IEC 27701Privacy Information Management
• ISO/IEC 42001Artificial Intelligence Management System