Attestation · Last verified
SOC 1
SOC 1 is an AICPA attestation on a service organization's controls relevant to user entities' internal control over financial reporting. The AICPA describes SOC as a suite of service offerings CPAs may provide, and the output is a report — not a certificate.
- Class
- Attestation
- Owner
- AICPA
- Who asks for it
- Buyer-driven
- Last verified
What it is
SOC 1 belongs to the AICPA's SOC reporting suite. In the AICPA's own words, "SOC 1 is an examination of controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting." The AICPA describes the wider family as "a suite of service offerings CPAs may provide in connection with system-level controls of a service organization or entity-level controls of other organizations" — the output is a report, and the term "certification" does not appear on the AICPA's SOC 1 page.
Who owns it
SOC 1 is owned and maintained by the AICPA, which states that it "promulgates the professional standards for SOC engagements".
Who assesses it
The AICPA frames SOC as "a suite of service offerings CPAs may provide". Whether a SOC 1 examination may only be performed by a licensed CPA firm was not verified in the sources reviewed as of 29 August 2026 — confirm against the applicable AICPA attestation standard.
Who asks for it
The AICPA names the demand side directly: "SOC 1 reports are specifically intended to meet the needs of entities that use service organizations (user entities) and the CPAs that audit the user entities' financial statements (user auditors)." No legal instrument requiring a SOC 1 report was identified in the sources reviewed as of 29 August 2026 — confirm against the relevant sector regulator.
Sources
- AICPA — SOC 1 (scheme owner) ↗ — accessed
- AICPA — System and Organization Controls: SOC Suite of Services ↗ — accessed
Last verified:
This page is for information only; it does not accredit, certify or endorse any organisation. Requirements and programs change — always confirm against the primary source linked above.