SOC report

A SOC report is a report from an independent CPA firm about the controls a service provider uses. SOC stands for System and Organization Controls.

Request a professional

If you hand part of your operations to an outside provider, the report helps you judge the risks of doing so.

This entry is part of the Fairview Audit glossary. It explains the term in plain words so you can ask better questions of your vendors.

Why SOC reports matter in a cost review

Outsourcing moves work to someone else, but the responsibility for the result stays with you. Payroll processors, payment handlers, hosting providers and billing services all touch your numbers or your data. A SOC report is one of the ways a provider shows how it controls that work.

In a cost and contract review, the report helps in two ways. It tells you whether a provider has been examined at all. It also shows what the examiner looked at and what exceptions were found. A control failure at a vendor can become an error or a cost for you. Firms that handle this type of work are covered under SOC reporting.

A plain-words illustration

Suppose your business uses an outside company to process customer payments. You cannot walk through its systems yourself. Instead, you ask for its SOC report. The report describes the provider's controls, states what period or date was examined, and gives the examiner's opinion.

You read it the way you would read a building inspection summary. You are not looking for perfection. You are looking for whether the controls you depend on were covered, and whether anything went wrong.

The main types

SOC 1. Covers controls at a provider that could affect its clients' financial reporting. Use is usually limited to the provider's clients and their auditors.
SOC 2. Covers controls tied to a set of trust criteria: security, availability, processing integrity, confidentiality and privacy. Use is also usually limited.
SOC 3. Uses the same criteria as SOC 2 but gives a shorter, general-use summary without the detailed system description.

Reports also come as Type 1 or Type 2. In general terms, Type 1 looks at the design of controls at a point in time, and Type 2 also tests how they worked over a period. [VERIFY: confirm the current definitions of Type 1 and Type 2 with the standard setter]

How it shows up in a review

A partner firm may ask which vendors you rely on for financial or data processes. It may then ask whether you hold each vendor's current report. Points that matter include:

the date or period the report covers, and whether it is current
whether the services you actually use are in scope
exceptions the examiner noted and the provider's response
controls that the report says you must handle yourself, often called user controls
services the provider runs through another company, which may be left out of scope

If your own business is the service provider, a client may ask you for a report. Firms in our network that support this work can be found under SOC reporting. Whether a firm is licensed for such examinations is for the firm to state. [CONFIRM: a partner firm supplies and approves its statement about SOC examinations]

Common mistakes

Filing the report and never reading it. Read the scope, the exceptions and your own responsibilities.
Accepting an old report. A report from a past period may not describe the provider today.
Assuming it covers everything. It covers only the services and criteria named in it.
Mixing up report types. A SOC 1 report speaks to financial reporting controls. It is not a security review.
Treating a report as a guarantee. It is an opinion about stated controls, not a promise about results.

Note: This entry is general information. Professional standards for these reports change, and a CPA firm can explain the current rules. [VERIFY: confirm current attestation standards and report names]

Related terms and pages

Fairview Audit connects you with finance professionals and partner firms. The partner firm performs any examination, and the engagement and fees are between you and the firm.

Find out what you are overpaying.

Tell us what you need reviewed. We match you by hand with an independent partner firm. You keep your existing vendors.