What is SOC 1?
The audit report focused on controls that affect your clients’ financial statements - not security broadly.
SOC 1: definition
SOC 1 exists for service providers whose work affects their clients’ books - payroll processors, claims administrators, and similar. Its focus is controls over financial reporting, so the clients’ own auditors can rely on it. Like SOC 2, it comes in Type I (design at a point in time) and Type II (operating effectiveness over a period) flavors. The key distinction from SOC 2 is scope: SOC 1 is about financial-reporting controls, SOC 2 about security and the trust criteria.
- Reports on controls relevant to clients’ financial reporting (ICFR)
- For providers whose service affects client financial statements
- Type I (design) and Type II (operating effectiveness) reports
- Complements SOC 2, which covers security and the trust criteria
How Fintra handles it
For service businesses whose processing affects client financials, Fintra’s control and evidence layer supports SOC 1 the same way it supports SOC 2 - mapping the relevant financial-reporting controls, collecting evidence continuously, and flagging gaps. The unified audit trail means the same records support whichever report a client’s auditor needs to rely on.
Worked example
Frequently asked questions
What is the difference between SOC 1 and SOC 2?
SOC 1 reports on controls relevant to clients’ financial reporting (ICFR); SOC 2 reports on controls against the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy). SOC 1 is about financial-statement impact; SOC 2 is about data protection.
Who needs a SOC 1 report?
Service organizations whose processing could affect their clients’ financial statements - payroll processors, loan servicers, claims administrators, and similar. Their clients’ auditors request SOC 1 to rely on those controls in their own audits.
Are there Type I and Type II SOC 1 reports?
Yes, like SOC 2. Type I assesses control design at a point in time; Type II tests operating effectiveness over a period. Type II is generally more valuable because it demonstrates the controls actually operated throughout the period.
Does Fintra support SOC 1?
For providers whose processing affects client financials, Fintra maps the relevant financial-reporting controls, collects evidence continuously, and flags gaps - using the same unified, tamper-evident audit trail that supports SOC 2.
Keep going
Stay in the loop
One practical finance briefing a week - new guides, checklists, and benchmarks.
See how Fintra handles the numbers behind this term
Fintra is the AI Finance Operating System for SMBs - accounting, planning, payroll, equity, and AI governance on one shared data model, with a named human approving anything consequential. Free to start, no card required.
Talk to us