What is SOC 1?
SOC 1 (System and Organization Controls 1) is an assurance report by an independent auditor on the controls at a service organisation that are relevant to its customers’ internal control over financial reporting. The report is issued under the US attestation standard SSAE 18 (section AT-C 320) of the AICPA, the professional body of American accountants. Its international counterpart is ISAE 3402, which is used in the Netherlands as NBA Standard 3402. Customers and their auditors use a SOC 1 report to judge whether outsourced processes, such as payroll processing, ERP hosting or invoicing, are demonstrably under control.
SOC 1 has nothing to do with a Security Operations Center. Here the abbreviation stands for System and Organization Controls, an AICPA reporting family that includes SOC 1, SOC 2 and SOC 3.
🧠 How does a SOC 1 examination work?
A SOC 1 examination involves four parties: the service organisation (the supplier), the user entities (the customers), the service auditor who performs the audit, and the customer’s financial statement auditor (the user auditor). The user auditor relies on the report during the annual audit, so they do not have to test every supplier themselves. For US-listed companies, SOC 1 is also a standard part of compliance with the internal control assessment under the Sarbanes-Oxley Act (SOX 404).
The examination is assertion-based: management of the service organisation writes a system description and asserts that it is fairly presented and that the controls are suitably designed (and, for Type 2, operating effectively). The auditor then gives an opinion on that. A distinctive feature of SOC 1 is that the service organisation defines its own control objectives, such as “transactions are processed completely and accurately”. With SOC 2, by contrast, the auditor tests against the fixed Trust Services Criteria.
A SOC 1 report usually contains:
- Service auditor’s opinion - unmodified (clean), qualified or adverse
- Management’s assertion - the service organisation’s statement
- System description - services, processes, systems and subservice organisations
- Control objectives, controls and tests - for Type 2 with the nature, extent and results of testing, including exceptions
- Other information - optional and not examined by the auditor
🔄 What is the difference between SOC 1 Type 1 and Type 2?
| Feature | SOC 1 Type 1 | SOC 1 Type 2 |
|---|---|---|
| Opinion on description | Yes | Yes |
| Opinion on design of controls | Yes | Yes |
| Opinion on operating effectiveness | No | Yes, over a period |
| Point in time | A single date | Usually 6 to 12 months |
| Test results in the report | No | Yes, including exceptions |
| Typical use | First year, new service | Annual assurance for customer and auditor |
Auditors almost always ask for a Type 2 report, because only that shows that controls worked throughout the financial year. If the reporting period does not match the customer’s financial year, the supplier often issues a bridge letter: a management statement that no material changes occurred since the end of the period. That letter is not an auditor’s opinion.
🧱 What is inside and outside the scope of SOC 1?
SOC 1 covers only controls that can affect customers’ financial reporting. Typical control objectives fall into two groups:
- Business process controls - authorisation of transactions, completeness and accuracy of processing, reconciliations and timely reporting
- IT general controls (ITGCs) - logical access through IAM and RBAC, change management, IT operations such as job scheduling and backups, and incident management
In an OT context, this means asking whether only authorised engineers can change recipes, counters or batch records that later flow into the ERP system, and whether changes to that interface follow an approved procedure.
Outside the scope are cybersecurity and information security as subjects in its own right, service availability and the quality or safety of production. For those, SOC 2, ISO 27001 or, for OT suppliers, IEC 62443-2-4 are better suited. Also watch for two pitfalls that the report itself describes:
- Subservice organisations - under the carve-out method, a data centre or cloud platform for example is excluded from the examination; the report then lists the controls expected from that party (complementary subservice organization controls). Under the inclusive method they are tested.
- Complementary User Entity Controls (CUECs) - controls you as the customer must operate yourself, such as revoking accounts on time or approving input. If you do not, the assurance in the report does not fully apply to you.
🏭 When is SOC 1 relevant in an IT/OT environment?
OT data only becomes relevant to SOC 1 at the point where it enters the financial records. Production and quality control as such are out of scope. The question is therefore always: which process data determines an amount in the financial statements or on an invoice?
| Example process | Financial relevance | Does SOC 1 fit? |
|---|---|---|
| Production counts from SCADA or MES flowing into ERP | Inventory valuation, cost price, revenue | Yes, if a supplier manages the interface or system |
| Metering data for billing (energy, water, heat) via a Historian | Basis for invoiced amounts | Yes, for outsourced metering and billing processes |
| Batch registration and Tracking and Tracing | Mainly quality and recalls; inventory indirectly | Partly; quality aspects are outside SOC 1 |
| Machine hours and batch data for cost price calculation | Allocation of production costs and inventory valuation | Yes, if a service provider performs the calculation |
| Alarm Management and fault logging | Process safety and availability | No; SOC 2 or IEC 62443 fit better |
| ERP or MES hosting by a managed service provider | Processing of financial transactions | Yes, classic SOC 1 territory |
In regulated sectors such as pharma, data integrity of production records matters a great deal, but that is governed by GMP and 21 CFR Part 11, not by SOC 1. A SOC 1 report can at most provide supporting evidence for shared ITGCs.
🔁 How does SOC 1 relate to other reports and standards?
| Report or standard | Subject | Relationship to SOC 1 |
|---|---|---|
| ISAE 3402 | Financial reporting, international | International counterpart; similar in content |
| SOC 2 | Security, availability, processing integrity, confidentiality, privacy | Complementary; fixed Trust Services Criteria |
| SOC 3 | General-use summary of SOC 2 | No detailed tests, but can be shared publicly |
| SOC for Supply Chain | Production and distribution systems of manufacturers | AICPA framework since March 2020, based on SOC 2 criteria |
| ISO 27001 | Certification of the ISMS | A certificate, not an opinion on the operation of specific controls |
| IEC 62443-2-4 | Security requirements for OT service providers | Best fit for integrators and maintenance contractors |
| COBIT | IT governance and control | Common source of ITGC control objectives |
History: SOC 1 succeeded the SAS 70 report from 1992. In 2011, SAS 70 was replaced by SSAE 16 in the US and ISAE 3402 internationally, both for reporting periods ending on or after 15 June 2011. Since 1 May 2017, SSAE 18 applies, which places SOC 1 in section AT-C 320.
🧭 How do you assess a supplier’s SOC 1 report?
A SOC 1 report only adds value if you actually read it. A practical approach as part of third-party risk management:
- Scope - check that the service you buy, including locations and systems, is in the system description.
- Type and period - require a Type 2 with a period that covers as much of your financial year as possible, and ask for a bridge letter where needed.
- Opinion and exceptions - read the test results; even a clean opinion can contain exceptions that matter to you.
- Subservice organisations - for a carve-out, ask for those parties’ own SOC reports.
- CUECs - record who in your organisation operates each customer control, for example periodic access reviews.
- Additional evidence - combine with SOC 2, ISO 27001 or a supplier security questionnaire for OT-specific risks.
In the Netherlands, auditors usually ask for an ISAE 3402 report from an auditor registered with the NBA or NOREA; SOC 1 is mostly seen with US suppliers and with customers subject to SOX. Some audit firms issue a single report that meets both standards. Under the Dutch Cybersecurity Act (in force since 15 August 2026) you must manage supplier risks, but a SOC 1 report is not sufficient for that because it does not give a security opinion.
❓ Frequently asked questions
What does SOC 1 stand for?
SOC 1 stands for System and Organization Controls 1, the first report in the AICPA’s SOC family. A SOC 1 report covers a service provider’s controls that affect customers’ financial reporting. It has nothing to do with a Security Operations Center.
Is SOC 1 the same as ISAE 3402?
SOC 1 and ISAE 3402 are similar in content, but they are two different standards. SOC 1 falls under the AICPA’s US standard SSAE 18 (AT-C 320), while ISAE 3402 is the international standard of the IAASB. Some auditors prepare a single report that meets both.
What is the difference between SOC 1 and SOC 2?
SOC 1 assesses controls relevant to customers’ financial reporting, using control objectives chosen by the supplier. SOC 2 assesses security, availability, processing integrity, confidentiality and privacy against the fixed Trust Services Criteria. For the cybersecurity of an OT or cloud supplier, SOC 2 is therefore the better choice.
How long is a SOC 1 report valid?
A SOC 1 report has no formal validity period, but it describes a fixed date (Type 1) or period (Type 2). Auditors usually accept a SOC 1 Type 2 when its period covers most of the financial year, possibly supplemented by a bridge letter. That is why suppliers repeat the SOC 1 examination every year.
Does an OT supplier need a SOC 1 report?
An OT supplier only needs a SOC 1 report if its service affects customers’ financial reporting, for example when it manages an MES-ERP interface or metering data used for billing. For purely technical services such as maintaining control systems, SOC 1 adds little. IEC 62443-2-4, ISO 27001 or SOC 2 fit better there.
Who can issue a SOC 1 report?
A SOC 1 report under SSAE 18 can only be issued by a licensed US CPA firm. Dutch accountants (NBA) and IT auditors (NOREA) issue the equivalent ISAE 3402 report under their own Standard 3402. Large international audit firms can often provide both.
📌 In summary
SOC 1 is an AICPA assurance report on a service provider’s controls that affect customers’ financial reporting, with ISAE 3402 as its international counterpart. Type 2 shows that controls worked over a period. In IT/OT environments, SOC 1 is only relevant where process data ends up in the financial records, such as MES-ERP interfaces or metering data for billing. For the security and availability of OT services, SOC 2, ISO 27001 and IEC 62443-2-4 are the right evidence.