Understanding SOC 1 (System and Organization Controls 1)
for User Entities and Service Organizations

How to Use SOC 1 to Ace Financial Audits, Build Reports, and Verify Internal Controls

Get My Free Trial Watch Video Demo Now

Get My Free Trial Watch Video Demo Now

What is SOC 1?

System and Organizational Controls 1, or SOC 1, helps user entities determine the effectiveness of their service providers’ internal controls for financial reporting (ICFR). The American Institute of Certified Public Accountants (AICPA) oversees SOC 1 guidelines, which companies can use to make sure third-parties they work with that handle financial and similar transactions implement industry recognized best practices for financial controls. Generally, CPAs audit service organizations and provide one of two SOC 1 report types, Type 1 or Type 2. In this SOC 1 resource, learn more about what the regulations are, who should be compliant, how to prepare for a SOC 1 audit report, and get the most out of your time with your CPA auditor.

What You'll Discover:

What is SOC 1?

SOC 1, System and Organization Controls 1, are standards to guide processes and controls for financial reporting.

Learn More

Who Needs to be SOC 1 Compliant?

User entities that outsource financial transactions, and service providers or sub-providers for those services, need SOC 1.

Learn More

Differences Between SOC 1, SOC 2, and SOC 3

There are multiple types of SOC reports, each one has different goals, objectives, controls, and reporting requirements.

Learn More

Understanding SOC 1 Reports

There are two types of SOC 1 reports. Which one do you need?

Learn More

Understanding SOC 1 Controls

Unlike other compliance programs, SOC 1 doesn't have a framework or detailed list of controls your organization should use.

Learn More

Helping Service Orgs With SOC 1

User entities are responsible for ensuring their service organizations are compliant with SOC 1 requirements.

Learn More

Preparing for a SOC 1 Audit

Learn what you can do to prepare for your SOC 1 report audit and how to decrease the time a SOC report usually takes.

Learn More

What to Expect During a SOC 1 Audit

Are you ready for your SOC 1 report? Solutions like Apptega's Audit Manager can help you know what to expect.

Learn More

SOC 1 Frequently Asked Questions

Check out answers to some frequently asked SOC 1 questions.

Learn More

Acing Your SOC Audit with Apptega

Apptega has everything you need to prepare you for a SOC 1 report so you'll have confidence you can ace your audit.

Learn More

SOC 1: Helping Companies Verify Service Organizations
Use Effective Internal Controls for Finance Reporting

System and Organization Controls 1 (SOC 1) are a set of standards companies (user entities) can use to determine how effectively their service providers (service organizations) implement and manage controls that may impact financial reporting. AICPA says these controls are “relevant to security, availability, and processing integrity of the systems the service organization uses to process users’ data and the confidentiality and privacy of the information processed by these systems.”

Some examples of SOC 1 user entities are:

Retailers and ecommerce businesses
Financial institutions
Government agencies
Healthcare organizations
Manufacturers

While user entities can outsource a range of financial tasks to service organizations, the user entity is ultimately responsible for ensuring providers implement effective controls for third-party services.

If you’re a service provider, for example, a software-as-a-service (SaaS) company or a data center, and your services may impact a user entity’s financial statements, then you may need to attest your business meets SOC 1 criteria. In simple terms, being a SOC 1 compliant service organization demonstrates you’re using industry recognized best practices to assess and manage risk. In some cases, an internal department within a larger organization could be considered a service organization.

Some other examples of SOC 1 services providers are:

Managed security providers (MSPs)
Managed security service providers (MSSPs)
Cloud-hosting services
Payroll processors
Human resources and employee benefits providers
Credit card processors
Customer relationship management software providers
Medical claims processors

In some cases, service organizations outsource services to other third parties. If those third-party services are relevant to the user entity’s ICFR, then they may also require SOC compliance. When this occurs, the service organization is responsible for the overall system of internal controls.

There are two types of SOC 1 reports, SOC 1 Type 1 and SOC 1 Type 2. Which SOC report is right for your organization depends on a number of factors, such as the nature of your business, types of services provided, types of data handled, and your company’s risk appetite. Certified public accountants (CPAs) manage SOC compliance reports.

Depending on report type, SOC reports generally include:

Names of user entity and service organization
Report scope
Information about your controls
Auditor’s comments about control design and how effective the controls perform

Learn More

SOC 1 Type 1 and SOC 1 Type 2 Reports

Simplifying SOC Compliance for Service Organizations

With the power of Apptega, you can simplify SOC 1 compliance and easily pass a Type 1 or Type 2 audit:

Select the best framework (or multiple frameworks) from a constantly-growing framework library
Select and implement controls and sub-controls to meet your SOC 1 objectives
Cross-walk your SOC 1 controls across multiple frameworks to meet report requirements for SOC 2, SOC 3, SOC for Cybersecurity, and SOC for Supply Chain
If you’re a user entity, get insight into all of your service providers’ SOC controls, all in a single platform
Quickly identify SOC compliance gaps or issues
Prepare for and ace your SOC 1 audit

Get Demo

Who Needs SOC 1 Compliance?

Does My Organization Need to be SOC 1 Compliant?

If you’re a user entity and you’ve partnered with service organizations to provide services that could impact your financial statements (for example a loan processor or your payroll company), then you’ll want to ensure they have effective internal controls for financial reporting. Getting a SOC 1 report from your service provider is a great way to do that.

If you’re a service provider and the services you provide could impact your user entity’s financial reporting, then you should get a SOC 1 audit report. Your user entity will use the report as part of their own internal financial process auditing.

In addition to that, the Sarbanes-Oxley Act (SOX) requires all publicly-traded companies that operate in the United States to implement internal procedures for financial reporting. SOX also makes CEOs and CFOs of publicly traded companies responsible for report accuracy and also for ensuring implementation of internal controls, completing financial report documentation, and submitting those documents to the appropriate agencies.

While a SOC report won’t necessarily mean you’re SOX compliant, it is a great way to measure your organization’s internal controls for finances.

If your services don’t impact financial statements, but you process other sensitive data, then you may need to be SOC 2 or SOC 3 compliant.

Apptega SOC Compliance Framework

Partner with Apptega for your SOC compliance journey. With the Apptega platform, you get comprehensive visibility into real-time SOC 1 compliance, can easily see how your controls function, and even get recommendations on how to mitigate compliance issues. You can also use Apptega to prepare for your SOC report audit, conduct internal audits, and continuously manage all of your SOC frameworks and controls going forward.

Get a Free Trial

The Differences Between SOC 1, SOC 2, SOC 3, and Other SOC Reports

According to AICPA, SOC reports help service organizations “build trust and confidence” that the services they perform have effective related controls that an independent third-party CPA has reviewed.

For many years, organizations attested to this by using State on Auditing Standards No. 70 (SAS 70). Also governed by AICPA, CPAs conducted audits based on SAS 70 standards. Eventually, AICPA replaced SAS 70 with Statement on Standards for Attestation Engagements (SSAE) No. 16 and then updated that with some clarifications to SSAE No. 18. The new regulations set attestation standards and require service organizations to provide written attestation about information system design, procedures, and controls, along with information about their effectiveness. This is where SOC reports were born.

SOC reports are not public and are restricted. Because they provide detailed information about controls, they’re considered confidential and generally only reviewed by the service organization, user entity, and CPA auditor. If a service organization refuses to share a SOC report, but a user entity must verify SOC controls, then the user entity may conduct its own control assessment on the service organization. For that reason, it’s common practice for service providers to share SOC reports with their user entities (customers).

SOC 3 reports are different. Because they don’t contain such detailed information, they can be freely distributed. A company, for example, could use SOC 3 report findings in their marketing efforts or share it on a website for transparency. SOC 1 and SOC 2 reports are limited and cannot be shared this way.

Here is a list of the SOC reports that may be applicable to your business:

SOC 1: Criteria for controls for a service organization as relevant to a user entity’s internal controls for financial reporting. SOC 1 reports are prepared based on AT-C Section 320: “Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting.”
SOC 2: Criteria for organizations to protect sensitive customer data, covering five trust service criteria: security, processing integrity, privacy, availability, and confidentiality. SOC 2 applies to any organization that stores, processes or transmits customer data. SOC 2 reports are prepared based on AT Section 101: “Report on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy.”
SOC 3: Similar to a SOC 2 report, but contains fewer details and is available for general use and for organizations that don’t need a SOC 2 report. The SOC 3 report also falls under AT Section 101.
SOC for Supply Chain: Criteria to help organizations, customers, and business partners identify, assess, and address supply chain risks.
SOC for Cybersecurity: Criteria to help organizations with cybersecurity risk management programs.

AICPA has created a three-question guide to help determine which report may be best for your needs. Ask:

Will your customers (user entities) and their auditors use the report to plan and perform an audit of their financial statements?

○ If yes, you need a SOC 1 report.

Will the report help your customers or stakeholders gain confidence and trust in your systems?

○ If yes, get a SOC 2 or SOC 3 report.

Do you need a report that’s generally available (shareable and not limited)?

○ If yes, get a SOC 3 report.

For service organizations trying to make decisions between a SOC 2 and SOC 3 report, ask:

Do your customers need (and have the ability to understand) the details of your processing and controls, tests an auditor will perform, and results?

○ If yes, you need a SOC 2 report.

○ If no, you need a SOC 3 report.

SOC 1 Type 1 and SOC 1 Type 2 Reports

AICPA focuses on promoting best practices to help organizations fairly and accurately handle financial reporting and management. SOC reports are an example of this. Each report type has a specific purpose and function. For SOC 1 compliance, there are two report types:

SOC 1 Type 1 Report: Evaluates the fairness of “the presentation of management’s description of the service organization’s system and the suitability of the design of the controls to achieve related control objectives included in the description.” The SOC 1 Type 1 report details an organization’s implemented procedures and controls at the time of the audit, along with the auditor’s testing and findings. In simple terms, a SOC 1 Type 1 report evaluates the control design an organization uses to protect assets and data. A CPA reviews these controls and then provides an opinion about the design of the financial reporting controls.

SOC 1 Type 2 Report: Similar to the Type 1 report, a SOC 1 Type 2 report goes deeper and also evaluates required control effectiveness in meeting related control objectives. Unlike a SOC 1 Type 1 report that’s a point-in-time review, a SOC 1 Type 2 report is for a specific audit period. Here, the auditor reviews procedures and controls and reports on how well they functioned during that time frame. This is usually over six months or more. SOC 1 Type 2 reports are more detailed than SOC 1 Type 1. Think of a SOC 1 Type 2 report as a report card. It does more than just indicate if a service organization’s controls pass or fail. It also details where issues exist with recommendations to rectify them.

While there is no “certification period” for a SOC 1 report, user entities generally accept a report for the previous year. After that, it’s best practice to undergo an updated assessment to ensure controls are still effective, especially as the service organization’s environment changes.

Understanding SOC 1 Controls

While there is not a specific SOC 1 framework or mandatory SOC 1 controls or sub-controls, AICPA indicates that control objectives should be “reasonable” in circumstances as they relate to assertions commonly used in user entity financial statements and to which the service organization could reasonably be expected to relate.

SOC 1 control objectives are flexible so service organizations can tailor them to the specific services they provide and align with industries served. According to AICPA, in a SOC 1 audit, control objectives are used as criteria to determine if an organization’s controls are “suitably designed and operating effectively.” As related to a user entity’s ICFR, the service organization’s related controls should be:

Relevant
Objective
Measurable
Complete

In general, there are a few recommended control objectives for service organizations:

General business processes
Information technology (IT) controls
- Change management (changes in applications, systems, network infrastructure, etc. are authorized, tested, documented, approved, and implemented)
- Computer operations (applications, systems, data transmissions, etc. execute in a complete, accurate, and timely manner without affecting user entity control over ICFR)

If a service organization operates within an industry or location that has compliance or other regulatory requirements, they are also expected to meet those standards, which may be reviewed during a SOC compliance audit.

While there is no one-size-fits-all controls checklist for SOC compliance, AICPA encourages organizations to include five key characteristics of their control activities descriptions:

Who is responsible for conducting the risk-mitigating activity
Frequency (or timing of) the control
Information about the specific risk-mitigating activity
Source of information, as applicable
Action taken with results of the control activity

Since SOC 1 Type 2 reports span a specific time period, organizations should also report on any changes that occur to their systems that could affect user entity ICFR during that time.

Another important piece of selecting the right controls for SOC compliance, is the organization’s ability to conduct an accurate risk assessment so it can effectively define control objectives. AICPA offers this guidance on the risk assessment process:

Using the control objectives that management has identified, identify related risks that could prevent the control objective from being met
Calculate the level of inherent risk
Describe the controls and evaluate control design
Test control operating effectiveness and evaluate results
Analyze controls to see if they mitigate the risk
Determine residual risk

In addition to these recommendations, there are many illustrative controls and other detailed compliance information in AICPA’s “Information for Management of a Service Organization in a SOC 1 Engagement” guide.

Help Your Service Organizations With SOC 1 Requirements

If you’re a user entity that outsources financial transactions and other related services, you’re responsible for ensuring your service organizations meet your SOC 1 requirements. But not every service organization understands SOC compliance and some may not have the in-house skilled professionals or resources to implement and manage necessary controls.

If you feel the risks introduced by a service provider exceeds your risk threshold and may negatively impact your financial reporting abilities, consider vetting other vendors as replacements.

Another option is to work directly with your service providers to help them understand and implement the appropriate SOC 1 controls. It may also be helpful to include this information in your service level agreements (SLAs).

Here are a few other tips to help your service organizations get ready for a SOC 1 compliance audit:

Identify the services the organization provides for your company and their impact on your ICFR.
Identify related risk
Understand (and explain to the provider) the impact of non-compliance, using real-world examples and dollar amounts for emphasis.
Review the organization’s existing controls and procedures. This will give you insight into their current SOC compliance posture and can help develop a roadmap to get them where they need to be.
Talk with your service organizations about their existing business continuity, operational resilience, and incident response plans, and cybersecurity programs. If they don’t already have these in place, connect them with resources to help.
Establish key performance indicators (KPIs) to help the provider understand SOC program effectiveness and goal-setting.
Routinely monitor their progress.
Build a culture that encourages and supports ongoing communication and teamwork to meet these unified goals.

Preparing for a SOC 1 Audit

While there is not a specific certification for SOC 1 compliance, there are some things you can do in advance to prepare for your SOC 1 report audit.

First, understand the type of SOC report you need. If you’re unsure, review the Differences Between SOC Reports section on this page. To make this determination as a service organization, you may also need to identify all of the user entities that are your customers and understand their SOC requirements. If you’re a user entity, be sure to communicate to all of your service providers the SOC report type you need.

The next step is to define your organization’s systems. AICPA says this written description, which is the responsibility of management, should include:

Services provided to user entities
The date (Type 1) or period (Type 2) to which the description relates
Control objectives specified by management or third party
- If not management, specify whom
- Objectives should also include risk mitigation
Related controls

Once you’ve identified services and controls, map the controls to your control objectives, then test the controls to see if they meet the objectives. If they do not, identify gaps and make plans to address them.

Once you’ve resolved any performance issues, it’s time to select an auditor and begin the engagement process. If you need help, consider using the AICPA’s Firm Search function.

What to Expect During Your SOC 1 Audit

Many companies offer SOC readiness assessments to determine if you’re ready for a SOC 1 audit. During a readiness assessment, your consultant or software solution should give you insight into the processes, controls, and documentation you already have in place, how they’re performing, discover gaps or other issues, and make recommendations to mitigate those issues before your actual CPA audit.

There are also software solutions to help you prepare. Apptega’s Audit Manager, for example, can assess your current controls and sub-controls with a real-time compliance assessment, help you prepare and store all the documentation required for the audit, and enable you to track your audit processes — all within a single platform.

And, if you need more help and want to work with a SOC 1 consultant or need other resources, you can find everything you need in Apptega Edge.

Once you’ve determined you’re ready, it’s time to engage with your auditor. While each auditor's report may vary, here are some common areas auditors will likely address:

● Audit scope
● SOC report type
● Service organization assertions about controls and risk
● System and control descriptions including control objectives, activities, and user entity controls
● Auditor's findings
● Did management accurately describe control objectives?
● Is the design of the controls reasonable to the services provided?
● Which tests did the auditor conduct?
● After testing, did the controls perform as intended?
● Other information (for example, management response to any deficiencies found in the audit or other relevant information such as a business continuity plan)

Audit Prep with Apptega

Blogs

SOC 2 Audit Explained For SaaS Companies

As cyber-attacks increase across many industries, it’s important that your clients know—and trust—that your organization takes data security and privacy seriously. And now, more than ever, people need reassurances (and proof) that your organization has controls to keep their data safe. This trust is built on transparency and professionalism, both of which are industry best practices and vital components on AICPA’s trust services criteria. As a SaaS company, a SOC 2 audit can help you demonstrate to your clients that you’re taking proactive measures to ensure your client’s data is safe.

Intelligent Framework Mapping: The New Harmony

Today’s modern enterprises—regardless of size—depend on a variety of frameworks to help build cybersecurity programs and ensure compliance and regulatory standards are met. Most organizations today face an increasing number of compliance mandates, which simultaneously increasing the number (and variety) of security frameworks they use to increase their cybersecurity posture. Managing those frameworks or mapping them to one another has long been a challenge for security professionals—until now, thanks to Apptega’s Harmony, the only intelligent framework mapping tool you’ll ever need.

Revolutionize Your Cybersecurity with Change and Configuration Management

Configuration management is a way to identify, control, track, and audit changes as part of your cybersecurity program. Many security frameworks include configuration management in requirements. Whether you’re using recommendations like SOC 2 or more stringent requirements like ISO 27001, it’s important to understand the role of configuration management in keeping your organization safe. Check out this blog to learn more about how the two practices together to help increase your security posture.

How to Choose Which Cybersecurity Framework to Follow

There are more than 20 common cybersecurity and privacy frameworks available today, ranging from comprehensive requirements mandated by GDPR to recommendations like SOC 2. So how do you know which framework (or multiple frameworks) are best for your organization? Check out this on-demand webinar to learn more about common frameworks, what sets them apart, and how you can simplify framework management by using Apptega.

Watch Now

Secrets to Passing a Cybersecurity Audit

If you’ve invested time, money, and resources into building out your SOC 2 controls, you’ll want to do everything you can to ensure you have a successful SOC 2 audit. But where do you begin? How do you prepare? Check out this on-demand webinar to learn more from security experts that have been involved in auditing processes, learn more about common stumbling blocks, and get tips to help you prepare for a successful audit.

Watch Now

Building Cybersecurity Programs for SaaS

As a SaaS company, your clients want to know that their data is secure within your organization, and with any related subcontractors you might outsource work to. But how do you build an effective cybersecurity program for your SaaS business, especially if you’re just getting started? Check out this on-demand webinar to learn how you can use SOC 2 and other frameworks to build your cybersecurity program with your existing resources.

Watch Now

Acing Your SOC 1 Audit with Apptega

Apptega has everything you need to prepare you for a SOC 1 report so you’ll have confidence you can ace your audit. If your organization already uses other frameworks and controls, for example, ISO 27001, NIST CSF, or NIST 800-53, you can get instant insight into what you already have in place that might apply to SOC 1 compliance.

You can even build your own SOC 1 framework based on your organization’s specific services, complete with customized controls to ensure you’re meeting your specific control objectives. And if you’re not, you can find recommendations to mitigate weaknesses before your audit.

Here are some of the other ways Apptega can help:
● Questionnaire-based audit assessments
● Automated and customizable reports
● Automated alerts and notifications
● Granular roles and permissions settings
● Document repository
● Ability to share documents and program information directly with your auditor

Get Demo

FAQs

What is SOC 1?

System and Organization Controls 1 (SOC 1) are a set of standards companies (user entities) use to determine how effectively their service providers (service organizations) implement and manage controls that may impact financial reporting.

How does SOC 1 work?

If you’re a service organization and the services you provide may impact your customers’ internal controls for financial reporting, you should get an audit for SOC 1 report. Before you get the audit, you’ll need to:
● Determine which type of SOC report you need
● Understand the scope of the report
● Outline services that may impact ICFR
● Develop control objectives to mitigate risk of these services to your customers
● Select and implement controls
● Test controls and address gaps
● Document SOC-required processes, controls, and other information
● Engage with a CPA for your SOC audit

Who oversees SOC 1?

The Association of International Certified Professional Accountants (AICPA) oversees SOC 1 and other SOC report types and their standards.

What are the different types of SOC 1 reports?

There are two types of SOC 1 reports: SOC 1 Type 1 and SOC 1 Type 2.

What is a SOC 1 Type 1 report?

A SOC 1 Type 1 report evaluates the control design a service organization uses to protect assets and data.

What is a SOC 1 Type 2 report?

A SOC 1 Type 2 report is similar to a SOC 1 Type 1 report, except it goes deeper and also evaluates required control effectiveness in meeting related control objectives.

Who needs a SOC 1 audit?

If you’re a service organization and the services you provide may impact a user entity’s financial statements, then you should get a SOC 1 audit. If you outsource those types of services to third-parties, you’re also responsible for ensuring they’re SOC 1 compliant.

What are SOC 1 user entities?

A SOC 1 user entity is any type of organization that outsources financial transactions, financial auditing, or similar financial services to a third party. Examples of SOC 1 user entities are retailers, ecommerce businesses, and financial institutions.

What is a SOC 1 service organization?

A SOC 1 service organization is a company that provides services to a user entity that could impact that entity’s financial reports, for example: credit card, payroll, and benefits processors; data centers; SaaS companies; cloud services providers (CSPs); MSPs; and MSSPs.

Who is responsible for SOC 1 compliance?

User entities are responsible for ensuring their service providers meet the appropriate SOC reporting standards. Service organizations that outsource services to other third parties are responsible for ensuring those sub-organizations are also compliant.

What is a SOC 1 audit?

A SOC 1 audit is a third-party evaluation, testing, and report on how service organizations protect client data, focusing primarily on internal controls related to financial reporting.

Who conducts a SOC 1 audit report?

A certified public accountant (CPA) performs a SOC 1 audit and issues a SOC 1 report based on the auditor’s findings.

Are SOC 1 reports mandatory?

The Sarbanes-Oxley Act (SOX) requires all publicly-traded companies that operate in the United States to implement internal procedures for accurate financial reporting and SOC reports are a way to meet that requirement. Additionally, a service providers’ clients may also require a SOC 1 report to ensure the organization has best practice internal controls that protect their data and may impact financial statements.

How long is a SOC 1 report valid?

There is no expiration date on a SOC 1 report, but generally, most user entities will accept a SOC report that covers the previous year. After that, a service organization should get an updated SOC 1 report.

How long should it take to complete a SOC report?

Many factors can influence how long it takes to complete a SOC report, for example, the type of SOC report needed, as well as the type of services provided and data accessed. Some SOC reports can be wrapped up in a few weeks. Others may take several months. You can speed up the audit process by ensuring you’re prepared before the audit begins. Consider using a solution like Apptega Audit Manager to help.

Does SOC 1 have a framework or controls?

No. There is not a specific SOC 1 framework or control list. Service organizations are expected to implement reasonable controls to mitigate risk to user entity data.

How much does a SOC 1 report cost?

The cost of a SOC 1 report varies based on many factors.
For example:
● Type of report needed
● Scope of services
● Size of company
● Volume of in-scope assets
● Level of risk services introduce for user entities
● Existing business processes and controls
● IT infrastructure
● Geographical location
● How prepared you are for the audit

What is SOC 2?

SOC 2 is a set of standards organizations can use to protect sensitive customer data across five trust service areas: security, processing integrity, privacy, availability, and confidentiality. SOC 2 applies to organizations that store, process, or transmit customer data.

What is SOC 3?

SOC 3 is similar to SOC 2, but because it contains less detailed information about an organization’s controls, it’s not limited and is available for general use. SOC 3 reports are also for organizations that aren’t required to have a SOC 2 report, but want to build customer confidence in their controls and processes to protect data.

What is SOC for Supply Chain?

SOC for Supply Chain helps organizations, customers, and business partners identify, assess, and address supply chain risks.

What is SOC for Cybersecurity?

SOC for Cybersecurity provides guidance for organizations with cybersecurity risk management programs.

What are some benefits of a SOC 1 report?

There are many benefits of a SOC 1 report.
For example:
● Identify potential risk your services may introduce for your clients
● Insight to mitigate risk
● Best practice implementation and management
● Increased customer satisfaction and trust/customer retention
● Enhanced brand reputation
● Decreased likelihood of reporting errors
● Fewer audit processes
● Competitive advantage/attract new customers

Are SOC 1 and HITRUST the same?

No. SOC 1 and HITRUST are not the same. HITRUST is a control framework and requires a certification. SOC 1 does not have a set framework or certification, but requires an attestation of compliance. Qualified third parties conduct HITRUST and SOC 1 audits.

What is the Sarbanes-Oxley Act (SOX)?

The Sarbanes-Oxley Act (SOX) requires all publicly-traded companies in the United States to implement internal procedures for accurate financial reporting.

What is SSAE 18?

SSAE 18 is an abbreviation for Statement on Standards for Attestation Engagement No. 18. It’s a set of auditing standards overseen by the American Institute of Certified Public Accountants (AICPA). It replaced SSAE 16 by providing more clarity to existing standards. SSAE guides all attestation engagements and SOC 1 is a similar type of assessment.

Understanding SOC 1 (System and Organization Controls 1)
for User Entities and Service Organizations

What is SOC 1?