Audits and compliance are just part of doing business for financial organizations. Clients and partners must know that they can trust you to manage their critical information, keep it secure, and maintain its confidentiality. Frameworks like Systems and Organization Controls, or SOC, help organizations meet these expectations in a standardized way. 

While SOC 2 is generally the more popular all-purpose attestation for businesses, SOC 1 attestation is just as necessary, if not more, for financial service providers. 

What Is a SOC 1 Report?

Systems and Organization Controls (SOC) is a framework intended to help organizations audit systems handle sensitive data about financial services. Created by the American Institute of Certified Public Accountants (AICPA), SOC provides a clear set of guidelines that a business can follow to secure their systems, protect customer data and instill trust with their clients. 

While SOC 2 reports are generally the most well-known, SOC 1 reports are critical for organizations in the financial services industry. A SOC 1 report relates to an organization’s ability to manage and protect internal financial statements. More specifically, these reports demonstrate that their IT systems can protect critical, private and sensitive data related to the reporting of financial statements. 

This might seem counterintuitive, and SOC 2 reports are often easier to understand. The key difference between the two is that a SOC 2 report shows how an organization protects sensitive data through a critical set of criteria (security, confidentiality, etc.). SOC 1, on the other hand, focuses on any internal systems responsible for reporting on financial information, especially when those systems are subject to audit by partners and clients. 

There are two different types of SOC 1 reports:

• Type 1 reports cover an assessment of these IT systems during a specific time and date. 
• Type 2 reports cover assessments over a period of time, usually 6 to 12 months. This test also includes a more in-depth report on the testing methods used during the audits, the results of those tests and how they demonstrate security capabilities. 

Type 2 reports contain all the information within a Type 1 report but cost more time and money to audit. Type 2 reports, however, can demonstrate to your clients and partners a commitment to compliance and system integrity with more transparency. 

SOC 1 audits are conducted by independent auditors licensed by the AICPA as a CPA firm. As such, many auditors either start as a CPA and bring in security services to help with audits or begin as a security firm and apply for CPA certification to offer higher-end security products to the financial market. 

What Is the Process for a SOC 1 Audit?

The SOC 1 compliance process starts with you, the business, ensuring that they can provide the right information and understand your responsibilities under the guidelines. 

The key steps in SOC 1 compliance include the following:

• Establish Assessment Scope: Determine the systems within your organization that will handle financial information for the purposes of reporting. This includes any system that might come under audit by industry organizations or clients to ensure their integrity and security. 
• Perform Risk Assessment and Gap Analysis: With the scope defined, you must next conduct a risk assessment and gap analysis to understand the separation between IT system and reporting requirements under SOC 1 and your current IT system. Then, it would be best if you implemented the proper controls to meet SOC 1 requirements based on that assessment. 
• Seek Auditor and Share Information: While it might seem odd, your self-assessments help you prepare for proper assessments via a certified auditor. At this stage, you provide your findings and recommendations and provide a map of your IT systems and how they interact with sensitive data. 
• Define and Implement Control Objectives: In this context, control objectives are the practices and policies to handle sensitive data correctly. With the IT system security controls in place, you must now work with your auditor to define how you handle that data. 
• Review and Attestation: Once risk is assessed, IT controls implemented and control objectives deployed to the satisfaction of SOC standards, the auditor can sign off on your attestation. 

As part of preparing for an audit, your organization must provide accurate information to the auditor. This information should include the following items:

• Descriptions of processes and system controls implemented by your organization and how they meet the obligations of security, privacy, integrity and confidentiality of sensitive data. 
• A control matrix mapping implemented technology and controls to employees responsible for using or maintaining them.
• Documentation related to critical aspects of your audited infrastructure, including those for administrative and security policies, security, vendor relationships and cloud service provider contracts. This should also include records of all system changes over time and any previous audits.  

What Do SOC 1 Auditors Look For in an Assessment?

The auditor will use SOC 1 guidelines and the information from your self-assessment and system descriptions to guide their investigation during the assessment. They will look at business processes, IT systems, operations and policies and compare them against SOC 1 standards and industry regulations to make their determinations. 

Generally speaking, they will look at a few types of controls and how they are implemented:

• Manual Controls: These are any controls that you or your employees require manual operation, including in-person accounting or the handling of physical funds or financial records. 
• IT Manual Controls: Like manual controls, these controls include any manual processes where IT systems assist in manual processes. 
• Application Controls: System controls for application and resource security. Includes technologies like identity and access management (IAM), multifactor authentication (MFA) or other authorization controls. 
• IT General Controls: Other technological controls, and usually the bulk of the audit. These controls include policy controls and management, physical system security, and change management. 

Complete Your SOC 1 Attestation with Lazarus Alliance

SOC 1 attestation isn’t simple, but it is an important and effective way to provide peace of mind to your clients. With Lazarus Alliance, you can work with an organization that focuses on security first. Unlike many other auditors, we are first and foremost a security firm with CPA certification to bring our expertise to the financial sector. 

Ready For Your SOC 1 Attestation?

Call Lazarus Alliance at 1-888-896-7580 or fill in this form.