They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
AT-C 320 · FIVE COSO COMPONENTS
The Complete ICFR Readiness Guide
A phased preparation framework for service organizations whose operations affect user entities’ financial statements. From scoping control objectives to coordinating with the CPA firm, every step you need to reach examination-ready status.
- 4-phase readiness checklist: scoping through pre-audit testing
- CPA coordination playbook — walkthroughs, evidence requests, assertions
- 6 common audit findings and how to prevent each one
- 4 evidence types auditors apply, ranked by persuasiveness
100+ SOC 1 Engagements · 1,000+ Audits Across India, USA, UK, Australia & UAE
4PhasesScoping to pre-audit
20Checklist ItemsAcross all phases
6Top FindingsAnd how to prevent them
10FAQsExpert answers
Direct answer: SOC 1 audit preparation means making your controls over financial reporting (ICFR) examination-ready before an independent CPA firm arrives. Under AICPA SSAE 18 (AT-C Section 320) in the United States — or ISAE 3402 internationally — the CPA opines on whether your controls are suitably designed (Type I) and operating effectively (Type II) to achieve stated control objectives that matter to user entities’ financial statements. Preparation follows four phases: scoping the services and control objectives, designing and documenting controls, building the evidence base, and running internal tests before the CPA walks through your system.
Key Takeaways
- SOC 1 preparation centers on ICFR — controls relevant to user entities' financial statements, not IT security in general. Every control objective must trace to a financial-statement impact.
- The 4-phase approach (scope, design, evidence, pre-audit testing) typically takes 4-6 months from kickoff to CPA engagement for a first-time SOC 1.
- Pre-audit internal testing is the single most effective step: find and remediate gaps before the CPA arrives, because findings discovered during the examination appear in the final report.
- CPA independence is non-negotiable — the firm that attests cannot be the firm that built the controls. Engage a compliance partner for preparation and a separate CPA firm for the examination.
Phased Preparation
Pre-Audit Readiness Checklist
20 items organized into four sequential phases. Complete each phase before moving to the next — scoping errors cascade downstream into control-design gaps and evidence shortfalls.
Phase 1 — Scoping
Define what the SOC 1 engagement covers and why.
5 items
- Identify every service you provide that feeds into a user entity's financial statements (e.g., payroll processing, claims adjudication, loan servicing, fund accounting)
- Map each service to specific financial-statement line items it affects (revenue, expenses, assets, liabilities)
- Draft control objectives that directly link to the financial relevance of each service — not generic IT objectives
- Identify subservice organizations (hosting providers, payment processors, custodian banks) and decide on the inclusive vs. carve-out method for each
- Define system boundaries: applications, infrastructure, people, procedures, and data flows in scope
Phase 2 — Control Design
Document and structure the controls the CPA will test.
5 items
Phase 3 — Evidence Collection
Build the evidence base the CPA firm will sample.
5 items
Phase 4 — Pre-Audit Testing
Test internally before the CPA firm arrives.
5 items
Working With Your Auditor
CPA Firm Coordination
The relationship between your organization, your compliance consultant, and the CPA firm determines how smoothly the engagement runs. Here is what to expect at each stage.
Selecting a CPA Firm
• Choose a firm with demonstrated SSAE 18 / SOC 1 experience in your industry (payroll, fund services, claims, etc.) — not just SOC 2 generalists
• Confirm CPA independence: the firm cannot have designed, implemented, or operated your controls
• Request the firm’s peer-review report — this is the CPA equivalent of an audit of the auditor
• Agree on the observation window, report delivery date, and fee structure before signing the engagement letter
Walkthrough Procedures
• The CPA traces one complete transaction per major process — from initiation to financial-statement impact
• Prepare control owners with dry-run walkthroughs so they can explain each step clearly and produce artifacts on request
• Have the system description draft ready — the CPA reviews it for completeness against what they observe during walkthroughs
• Assign a single point of contact to coordinate walkthrough scheduling and follow-up questions
Evidence Request Management
• Expect a Prepared by Client (PBC) list weeks before fieldwork — start collecting immediately, not when they arrive
• Organize evidence in a shared repository with a consistent naming convention (Control-ID_Period_ArtifactType)
• Track every request, response, and outstanding item in a status tracker — missing PBC items delay the engagement and increase fees
• Respond to follow-up inquiries within 24-48 hours to maintain engagement momentum
Prevent Before They Appear
Common Audit Findings
These six findings account for the majority of SOC 1 exceptions across industries. Each is preventable with the right controls and evidence discipline.
Segregation of Duties Failures
The same person who initiates a transaction also approves or posts it. In payroll: the person who adds employees also runs the pay cycle. In fund accounting: the same analyst who prices a security also approves the NAV.
Prevention: Enforce role separation at the application level. Where small teams make full separation impractical, implement compensating controls: independent supervisory review of every transaction batch with sign-off before release.
Incomplete Change Management Documentation
Code reaches production without documented approval, testing evidence, or rollback plans. The auditor pulls 25 change tickets and three have no approval stamp.
Prevention: Enforce a gated deployment pipeline: no merge to production without a code review (separate from the developer), documented test results, and a change-advisory-board or delegate approval. Automate the gate in your CI/CD tool so it cannot be bypassed.
Stale Access Reviews
Quarterly access recertification either never happened or happened without genuine review — managers rubber-stamped a spreadsheet. Terminated employees still have active accounts weeks after departure.
Prevention: Automate deprovisioning on the termination date via HR-to-IAM integration. For recertification, use a tool that forces managers to explicitly confirm or revoke each entitlement, and block access for unreviewed accounts after the deadline.
Undocumented CUECs
Complementary user entity controls exist in the CPA's report, but your user entities have no idea they are supposed to operate them — or you have no way to verify they do.
Prevention: Maintain a CUEC register. During client onboarding, walk each user entity through the CUECs in plain language and get written acknowledgment. In the system description, describe each CUEC with enough specificity that the user entity's auditor can test it.
Reconciliation Gaps
Control says "daily reconciliation between subledger and GL," but evidence shows reconciliations were missed for 8 days in the observation window, with no documented reason or compensating review.
Prevention: Automate reconciliation runs and alert on failures. When a reconciliation genuinely cannot run (holiday, system outage), document the reason and the compensating review performed the next business day. The auditor expects a clean trail, not perfection.
Weak Monitoring of Subservice Organizations
You rely on a cloud host or payment processor but have no evidence you reviewed their SOC 1 or SOC 2 report, tracked their complementary controls, or escalated bridge-letter gaps.
Prevention: Request subservice SOC reports annually (or bridge letters for coverage gaps). Review each report's exceptions and CUECs. Document your assessment and any compensating controls. If using the carve-out method, ensure the system description clearly states what is excluded.
What Auditors Expect
Evidence Types Ranked
CPA firms use four evidence-gathering techniques under SSAE 18. Understanding the hierarchy helps you prepare the right artifacts and anticipate how each control will be tested.
Inquiry
Low — corroborative only
The auditor interviews control owners about how a control works. Inquiry alone is the weakest form of evidence — it supports understanding but never stands as sole proof that a control operated.
Example: Asking the payroll manager how new-hire authorizations are verified before the first pay run.
Inspection
Moderate to high
The auditor examines documents or records to confirm the control operated. This is the most common evidence type for manual controls — the auditor reviews the artifact and confirms it was completed correctly and on time.
Example: Reviewing a sample of 25 change tickets to confirm each has documented testing, a reviewer signature distinct from the developer, and an approval stamp before the production deploy date.
Observation
Moderate — point-in-time only
The auditor watches the control being performed in real time. Observation proves the control operated at a single point — it does not prove it operated consistently throughout the observation window.
Example: Watching the data-center badge-access procedure as an employee enters the restricted server room, confirming the guard verifies the access list.
Reperformance
Highest
The auditor independently re-executes the control to verify the same result. Reperformance is the strongest evidence type because the auditor does not rely on the service organization's documentation — they prove the control works by running it themselves.
Example: Independently recalculating a sample of payroll tax withholdings and comparing the result to what the system produced, or re-running the daily subledger-to-GL reconciliation on a randomly selected date.
Required Deliverable
The Management Assertion Letter
Every SOC 1 report opens with a management assertion — a formal statement from your organization’s leadership (typically the CEO, COO, or VP of Operations) that accompanies the CPA’s opinion. The CPA does not opine in a vacuum. They opine against your assertion. Without it, the engagement cannot proceed.
The assertion covers three elements:
1
System description accuracy
The system description included in the report fairly presents the system as designed and implemented throughout the specified period (Type II) or as of a specified date (Type I). This includes the services provided, the infrastructure, the control environment, and the boundaries of the system.
2
Suitability of control design
The controls stated in the description were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively — and user entities applied the complementary controls identified in the description (CUECs).
3
Operating effectiveness (Type II only)
The controls operated effectively throughout the specified period to achieve the stated control objectives. This is the assertion that requires a full observation window of evidence — it is what distinguishes a Type II from a Type I.
Practical tip: Draft the assertion letter early in the preparation process — not the week before the CPA arrives. Writing it forces you to confirm that your system description is accurate, your control objectives are achievable, and your evidence base supports every claim you are about to make. If you cannot sign the assertion with confidence, you are not ready for the examination.
Continue Your SOC 1 Research
SOC 1 Timeline
How long the engagement takes from kickoff to report delivery
Read guideSOC 1 Cost Guide
Pricing factors for Type I and Type II engagements
Read guideICFR Controls
Deep dive into controls over financial reporting
Read guideSOC 1 vs SOC 2
When you need ICFR controls vs Trust Services Criteria
Read guideSSAE 18 Standard
The governing attestation standard for SOC 1 in the US
Read guideType I vs Type II
Design-only vs design-and-operating-effectiveness
Read guideSOC 2 Overview
Trust Services Criteria for technology companies
Read guideSOC 1 Hub
All SOC 1 resources in one place
Read guideProof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Expert answers on SOC 1 readiness, CPA coordination, evidence, and the management assertion.
How far in advance should we start preparing for a SOC 1 audit?
Start 4-6 months before you want the CPA's report issued. The first 2 months cover scoping, control design, and evidence-repository setup. The remaining time fills the observation window (for Type II) or lets you remediate gaps found in internal testing (for Type I). Organizations preparing for their first SOC 1 should budget closer to 6 months.
What is the difference between SOC 1 Type I and Type II for audit preparation?
Type I tests whether controls are suitably designed at a single point in time — you need clean documentation and current artifacts but no operating history. Type II tests design plus operating effectiveness over a period (typically 6-12 months), so you must collect evidence continuously throughout the observation window. Type II preparation is more demanding because every control must have a provable track record, not just a snapshot.
Who selects the CPA firm that issues the SOC 1 report?
You (the service organization) select and engage the CPA firm. The CPA must be independent — they cannot have performed the implementation work. A compliance consultant like Tranquility Cybersecurity helps you prepare, but the attestation opinion comes from the licensed CPA firm. Choose a firm with specific SOC 1 / SSAE 18 experience in your industry, not just general audit capability.
What is a management assertion in a SOC 1 report?
The management assertion is a formal written statement from the service organization's leadership declaring that: (1) the system description fairly presents the system as designed and implemented, (2) controls were suitably designed to achieve the stated control objectives, and (3) for Type II, controls operated effectively throughout the specified period. The CPA's opinion is issued against this assertion — it is not optional.
What are CUECs and why do they matter for SOC 1 preparation?
CUECs (Complementary User Entity Controls) are controls that your user entities must operate for your own controls to be fully effective. Example: your payroll system processes what the client submits, so the client must control the accuracy of employee data they send you. CUECs appear in the SOC 1 report and the user entity's auditor tests them. Undocumented or unrealistic CUECs are a top finding.
How does the carve-out vs. inclusive method affect preparation?
If you use a subservice organization (e.g., AWS for hosting, a custodian bank for asset safekeeping), you choose how to address them. The carve-out method excludes the subservice from your scope — you describe the boundary and your CPA does not test their controls. The inclusive method includes them, requiring additional coordination and testing. Most first-time SOC 1 engagements use the carve-out method to reduce complexity.
What evidence do SOC 1 auditors typically sample?
Auditors sample transaction-processing records (e.g., 25-45 payroll runs or trade confirmations), access-provisioning and removal tickets, change-management records with approvals and test evidence, reconciliation files between subledgers and the general ledger, exception and error-handling logs, and supervisory review sign-offs. For Type II, samples span the entire observation window, not just recent months.
Can a SOC 1 finding be remediated during the audit?
If the CPA identifies an exception during testing, the finding appears in the report — it cannot be "erased" by a mid-audit fix. However, you can include a management response describing the remediation taken and the date it was effective. This is why pre-audit internal testing is critical: find and fix gaps before the CPA arrives so they never become formal exceptions.
How is a SOC 1 audit different from a SOC 2 audit in terms of preparation?
SOC 1 focuses on controls relevant to user entities' financial statements (ICFR) under SSAE 18 / AT-C Section 320. SOC 2 focuses on the Trust Services Criteria (security, availability, confidentiality, processing integrity, privacy) under AT-C Section 205. SOC 1 preparation requires mapping every control to a financial-statement impact and drafting control objectives tied to ICFR. SOC 2 preparation maps controls to the common criteria. The evidence-collection mechanics are similar, but the scoping logic is fundamentally different.
What does the CPA walkthrough process look like?
During a walkthrough, the CPA traces one end-to-end transaction through your system — from initiation (e.g., a client submits payroll data) through processing (calculations, validations, approvals) to output (pay stubs, tax filings, GL postings). They interview control owners, inspect the artifacts at each step, and may re-execute a calculation. The walkthrough tests design effectiveness and helps the CPA understand the system for their description review. Expect one walkthrough per major process in scope.
Keep Exploring
Related Reading
SOC 1
SOC 1 Knowledge Hub
Every SOC 1 guide — Type I vs II, ICFR controls, timelines, costs — in one place.
Read moreSOC 1
Who Needs a SOC 1 Report?
The one-question test: does your service change customers' financial numbers?
Read moreSOC 2
Types of SOC Reports
SOC 1 vs SOC 2 vs SOC 3 — audiences, criteria, and which one buyers ask for.
Read moreSOC 1
SOC 1 vs SOC 2
ICFR financial controls vs security and trust — which one, or both.
Read moreSOC 1
SOC 1 Cost Guide
What to budget for SOC 1 Type I and Type II — consulting + CPA fees.
Read moreSOC 1
SOC 1 Timeline
From scoping to CPA-attested report — phase-by-phase roadmap.
Read moreThe Learn Library
Go deeper.
SOC 1 · Learn
AT-C 320, Explained
The attestation standard every SOC 1 examination runs under.
Read moreSOC 1 · Learn
SOC 1 Bridge Letters
Covering the gap between report periods without losing assurance.
Read moreSOC 1 · Learn
SOC 1 Description Criteria
What the system description must contain — and how auditors read it.
Read moreSOC 1 · Learn
SSAE 18 vs SSAE 21
How the governing standards changed and what it means for your report.
Read moreLearn
SOC 1 vs SOC 2 vs SOC 3
Which report answers which question, and who may rely on each.
Read moreLearn
CUECs & CSOCs Explained
The controls a report assumes of you — the most skipped step in vendor risk.
Read more