Your client's auditor is asking about your controls.
A SOC 1 report answers them once, in the form they are required to accept. It covers the controls at your organization that affect your clients' financial reporting — issued under SSAE 18 by a licensed CPA firm.
SSAE 18
If your work lands in someone else's ledger, you probably do.
SOC 1 exists because your client's auditor cannot sign off on financial statements without understanding the controls at the service organizations that process those numbers. Any of these usually triggers a request:
Two different reports, two different readers.
Plenty of organizations need both, and a request for "your SOC report" often means the sender has not checked which. The distinction is who relies on it.
Where both apply, we scope them together: shared controls are tested once and reported into each engagement separately.
See the SOC 2 page →Design, or design and operation.
On bridge letters. When a client's year end falls after your report period closes, they will ask you to cover the gap. We issue a bridge letter as part of the engagement — but it is a statement from management, not an audit opinion, and a gap longer than about three months usually means the period needs moving rather than bridging.
Scoped backwards from your clients’ year ends.
A SOC 1 is not driven by your sales cycle. We plan the period so the report lands before the auditors who need it start their fieldwork.
Scoping call
Which services are in scope, which of your clients are asking, and when their auditors need it.
Control objectives
You state what your controls are meant to achieve. We draft with you and assess whether it is complete.
Assertion & period
Management signs its written assertion, the description is finalized and the reporting period is fixed.
Testing
Samples selected and tested against each objective, in batched requests on a published schedule.
Report & next period
Signed report, a description you can reuse, and next year's period agreed at close-out.
A report their auditor can rely on, and reuse next year.
All included in a standard engagement.
We are accountants first.
SOC 1 is a financial-reporting engagement. It rewards a firm that already understands close processes, journal entries and where misstatement actually comes from — not one that treats it as SOC 2 with different headings.
Our accounting practice works in US GAAP close cycles daily, so control objectives get written in language a controller recognizes.
You meet the practitioner before the engagement letter, and they stay on it until issue.
Where we already provide accounting services, we set out in writing what we can and cannot examine before you sign.
What controllers ask us.
Email if yours is not here. We reply within one business day, and we will say so if we are not the right firm for the work.
contact@assurionservices.comOur client just asks for "a SOC report". Which one?
Ask who wants it. If the request came from their finance team or their external auditor, it is almost always SOC 1. If it came from security or procurement, it is SOC 2. If nobody is sure, send us the request and we will tell you which one satisfies it.
Who writes the control objectives?
You do — that is how SOC 1 works, and it is also its advantage over a fixed-criteria report. In practice we draft alongside you, because a first-time description tends to be either too broad to test or too narrow to satisfy an auditor. Our role is then to assess whether the objectives are suitably stated and complete.
Can you audit us if you also do our bookkeeping?
Sometimes, and sometimes not — it depends on which processes are in scope. We will not test a control we operate for you. Where the overlap is limited we can carve it out; where it is central, the honest answer is that you need a different firm for the examination, and we will say so before you spend money with us.
What if we use subservice organizations?
You choose the inclusive method, where their controls sit inside your report and get tested, or the carve-out method, where they are excluded and identified. Carve-out is more common and cheaper; inclusive is stronger for the reader. We decide with you at scoping, since it changes both cost and what your clients' auditors have to do.
Is a qualified opinion the end of the world?
No, though it needs explaining. Exceptions get described with context and with management’s response alongside them, which is usually what a reader needs. You will hear about anything we find during walkthroughs or testing, not for the first time in the draft report.
What a SOC 1 costs.
Quoted individually, in writing, before anything is payable. There is no rate card — a SOC 1 for a two-process payroll bureau and one for a multi-platform loan servicer are not the same engagement.
Submitting a request and the scoping call are both free, and no card details are taken at either point. You receive a written fixed-fee proposal within three business days of the call — a single amount in US dollars, exclusive of applicable taxes, covering a stated scope and timeline. You are invoiced only after signing an engagement letter, and only for the fee stated in it. No subscriptions, no automatic renewals.
See how we price, our fees, payment, refunds and cancellation policy and terms of service. Please read both before submitting a request or making a payment.