02 / Compliance and certification
SOC 1, for the controls your clients' auditors depend on
We help you define control objectives, tighten the IT general controls beneath them and prepare evidence, so the CPA firm examines controls that are already working.
Overview
What a SOC 1 report is
A SOC 1 report covers the controls at a service organisation that are relevant to its user entities' internal control over financial reporting. If you process payroll, transactions, claims or other data that ends up in your clients' financial statements, their auditors will want to know they can rely on you.
The service organisation defines its control objectives, and the auditor tests the controls that achieve them. A Type 1 report covers design at a point in time; a Type 2 report also tests operating effectiveness over a period. IT general controls, such as access, change management and operations, usually carry a large share of the work.
The report is issued by a licensed CPA firm. Black Fox is not one. We do the readiness work, the gap assessment, control design and evidence preparation, and support you while the examination runs. We work with long-standing partner firms and coordinate the examination with them or with a CPA firm of your choice, so you go from readiness to the report in one engagement.
Who it is for
Service organisations whose work affects their clients' financial statements, such as payroll, payment, fund administration, claims processing and hosted finance systems, and teams asked for a SOC 1 report by a client's auditor for the first time.
The work, from scoping to evidence.
What we do
Scoping and objectives
We help you identify the services and systems that matter to your clients' financial reporting and draft control objectives that fit them.
Readiness assessment
A review of business process and IT general controls against those objectives, with gaps ranked by risk and effort.
IT general controls
Access management, change management, backups and job operations designed so they can be tested and leave evidence.
System description
Support in drafting the description, including subservice organisations and the controls you expect your clients to operate.
Evidence preparation
A request list built before the auditor sends theirs, with access reviews, change tickets and reconciliations collected as you go.
How the engagement runs
Kickoff
We agree the services in scope, the people involved and your target report date, and sign an NDA first if you need one.
Readiness assessment
Walkthroughs of the processes, document review and sampling, ending in a prioritised gap report.
Control design and remediation
We work with your owners to close the gaps and describe each control so it can be tested.
Dry run
We test samples as an examiner would and show you the exceptions before anyone else sees them.
Examination
We coordinate the examination with one of our long-standing partner firms or the CPA firm of your choice, and help you answer requests and deal with exceptions during fieldwork.
What you receive
- Scoping memo with services, systems and report type
- Draft control objectives and control matrix
- Readiness assessment report with a prioritised action plan
- IT general control procedures
- Evidence request list with owners and sources
- Dry-run findings before the examination
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Can Black Fox issue our SOC 1 report?
No. SOC 1 reports are issued by licensed CPA firms under AICPA attestation standards, independent of our readiness work. We prepare you, coordinate the examination with one of our long-standing partner firms or a firm of your choice, and support you during it.
SOC 1 or SOC 2?
SOC 1 is about controls relevant to your clients' financial reporting and is read mainly by their auditors. SOC 2 is about security and related criteria and is read by customers' security and procurement teams. Some organisations need both.
What is ISAE 3402?
An international assurance standard for reports on controls at a service organisation, widely used outside the United States. It serves a purpose similar to SOC 1. Which one you need depends on who reads the report.
Who writes the control objectives?
Your management does. The auditor then tests whether the controls achieve them. We help you write objectives that match what your clients rely on, neither too narrow to be useful nor too broad to evidence.
Related services
- Compliance and certificationSOC 2SOC 2 readiness from Black Fox Security: Trust Services Criteria scoping, gap assessment, control design and evidence preparation for your CPA firm's examination.
- Managed securityAccess reviewsPeriodic access reviews by Black Fox Security: user and privileged access across directories, cloud and key applications, joiners and leavers, audit evidence.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
- Governance and riskCOBITCOBIT support from Black Fox Security: a governance system for enterprise IT, governance and management objectives, capability assessment and ISO and NIST mapping.
Start before your client's auditor sends the questionnaire
Tell us which services your clients rely on for their financial reporting. We will show you what an examiner would test first.