Build trust with SOC 1 in 2023

The main driver we see for SOC 1 that comes with a financial reporting objective focus, is for publicly listed companies and their associated compliance with Sarbanes Oxley (SOX). That is where publicly listed companies need to prove they have effective internal controls including over critical systems they use. That includes third party software, so your publicly listed customers may ask you for a SOC 1 report covering your software as a service.

The service organisation control, now sometimes referred to as system and organisational control (SOC) standards have been around for decades. Their earlier use was driven by financial reporting objectives, later termed “SOC 1”. That’s where third parties would rely on IT systems or services, and that would impact their financial statement audits or other financial interests like in asset management or superannuation, as examples. 

As reliance on third party services evolved with the software as a service boom, these reports naturally evolved to being used for assurance over those third party services even if there were no direct financial objectives involved. The Trust Services Criteria were then introduced to better align to the modern needs of third parties that were reliant on the security, availability, confidentiality, processing integrity and privacy of third party services. This became “SOC 2” to differentiate from the earlier SOC 1 purpose.

A Type 1 report attests to your compliance by design. It’s a snapshot in time that can be achieved by showing you have the right systems and processes in place to satisfy the SOC 1 control objectives. 

A Type 2 report attests to your compliance by both design and operation over a period of time. It covers a period between 3-12 months to show your systems and processes have been operated consistently to satisfy the SOC 1 control objectives. 

Usually, a Type 1 report is issued first to baseline compliance. That marks the start of the live and recurring Type 2 audit periods for reports issued annually. That is the industry standard but the SOC standards have flexibility to choose the report dates and periods as desired (usually driven by customers’ expectations that drives that industry standard approach).

The control objectives in SOC 1 are flexible. They are adapted to specific customer requirements, especially if there are specific financial reporting objectives required to be covered. For a standard SaaS provider scope focused on the technology controls, it includes the following areas as control objectives:

Logical Access
Segregation of Duties
IT Perimeter Security
IT Processing
Change Management
Backups & Recovery
Incident Management
Resilience & Recovery
Vendor Risk Management