CYBER SECURITY COMPLIANCE · SOC 1
SOC 1 Consulting and Readiness Services
Internal Controls Relevant to User Entities’ Financial Reporting
A SOC 1 report exists for one audience: the auditors of your customers. When your service affects a client’s financial reporting, their audit firm needs assurance about your controls, and without a SOC 1 they will either ask your clients to compensate elsewhere or come and test you directly. Elevate Consult prepares service organizations for the SOC 1 examination, from scoping the control objectives through to the evidence an auditor will sample.
2026 UPDATE
What drives a SOC 1 requirement
The request comes from your customer’s auditor, not your customer
A SOC 1 is used by user entities and their auditors to evaluate the effect of your controls on their financial statements. That is why the request usually arrives during your client’s audit cycle rather than during a sales conversation, and why the timeline is rarely yours to set.
It is not a security report
SOC 1 addresses internal control over financial reporting. SOC 2 addresses security, availability, processing integrity, confidentiality and privacy. Organizations asked for one and offered the other create a problem for the requester rather than solving it, and many service organizations genuinely need both for different audiences.
Subservice organizations change the report
Where your service depends on other providers, the report treats them through the carve-out method, excluding their controls and identifying them for the reader, or the inclusive method, covering them within the report. That decision shapes scope and it shapes what your customer’s auditor still has to chase.
Complementary user entity controls shift work to the reader
A SOC 1 typically identifies controls your customers must operate for your controls to achieve their objectives. Writing those clearly reduces the follow-up questions; writing them vaguely produces a report that generates work instead of closing it.
It connects to your customers’ SOX programs
Where your user entities are public companies, your SOC 1 feeds their Section 404 assessment of internal control over financial reporting. That is why their auditors read it closely and why an exception in your report becomes their problem.
WHAT SOC 1 IS
An examination of controls affecting financial reporting
SOC 1 reports, as defined by the AICPA, evaluate controls at a service organization that are relevant to user entities’ internal control over financial reporting. They are performed by a licensed CPA firm under the attestation standards and produce an opinion, not a certificate.
The report is invaluable to user entities seeking assurance that their service providers maintain effective financial controls, and it is often the difference between a client’s audit proceeding smoothly and their auditor arriving at your door.
REPORT TYPES
Point in time or across a period
Type 1 assesses the design and implementation of controls at a specific point in time, confirming the foundational elements are sound. Type 2 evaluates both design and operating effectiveness across a reporting period, usually six to twelve months, showing how controls perform consistently. Most user entity auditors want Type 2.
Control environment
Governance and oversight
Governance, risk management and organizational structure, with clear roles and responsibilities, robust policies and effective oversight of third parties.
Information technology
IT general controls
Data integrity, system security and IT general controls including backups, data retention and change management processes.
Business processes
Transaction workflows
Transaction workflows assessed for completeness and accuracy, so the financial data flowing to user entities stays reliable and consistent.
Change management
Systems and databases
Controls over changes to systems, applications and databases, confirming updates are documented, tested and authorized before they reach production.
Logical access
Authorized personnel only
User access management restricting system access to authorized personnel, with provisioning, review and revocation traceable.
Physical security
Assets and sensitive data
Safeguards protecting assets and sensitive data, including physical access control, surveillance and environmental controls.
OUR PROCESS
Scoping through report support
Elevate uses a structured process that minimizes risk while maximizing control effectiveness, staffed with IT audit and accounting practitioners rather than security generalists.
Complementary user entity controls
Draft the controls your customers must operate, written clearly enough to reduce follow-up rather than generate it.
Control objective design
Draft control objectives that describe what your controls are meant to achieve for a user entity’s financial reporting, which is the part that determines whether the report answers the reader’s actual question.
Subservice organization treatment
Carve-out or inclusive method decisions for providers your service depends on, and the disclosure that follows from each.
Audit support
Available to answer questions, join meetings and speak with auditors through the examination, so the process does not stall on a question nobody owns.
Scoping and planning
Define the audit scope by pinpointing the areas most relevant to user entities’ financial reporting, develop a tailored assessment plan targeting specific control objectives, and build the request list covering documentation and evidence.
Gap assessment and remediation
Identify control weaknesses before they affect financial reporting or produce an exception in the report, with prioritized remediation and practical guidance.
ENGAGEMENT PHASES
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
GET STARTED
Ready to prepare for your SOC 1 examination?
Elevate scopes the control objectives around what your customers’ auditors actually need assured, closes the gaps that would otherwise produce an exception, and supports your team through the examination itself.
FAQ
Common Questions
What is the difference between SOC 1 and SOC 2?
Audience and subject. SOC 1 covers controls relevant to user entities’ internal control over financial reporting and is read by your customers’ auditors. SOC 2 covers security, availability, processing integrity, confidentiality and privacy, and is read by your customers’ security and procurement teams. Many service organizations need both, for different requesters.
Do we need Type 1 or Type 2?
Type 1 assesses design and implementation at a point in time. Type 2 assesses design and operating effectiveness across a period, usually six to twelve months. User entity auditors generally want Type 2, because a point-in-time opinion tells them little about the period they are auditing. Type 1 is sometimes used as a first-year step toward it.
What is a complementary user entity control?
A control your customer must operate for your control objective to be achieved. A SOC 1 typically identifies several, and they belong in the report because the reader needs to know what remains their responsibility. Written clearly they close questions; written vaguely they generate them.
What is the carve-out method?
One of two ways to handle subservice organizations your service depends on. The carve-out method excludes their controls from your report while identifying them, so the reader knows to obtain assurance separately. The inclusive method covers them within your report, which requires their cooperation and expands the examination. The choice affects scope, cost and how much work your customer’s auditor still has to do.
Who performs the examination?
A licensed CPA firm, under the AICPA attestation standards. Elevate prepares the organization for it and supports the team through the process, including auditor questions and meetings. Elevate does not perform the examination, which keeps the readiness work free of an independence conflict.
How does SOC 1 relate to our customers' SOX programs?
Directly, where those customers are public companies. Their Section 404 assessment of internal control over financial reporting relies in part on the controls you operate on their behalf, and your SOC 1 is how their auditor gains that assurance. An exception in your report becomes a question in their assessment, which is why the report is read more carefully than most service organizations expect.