ICFR CONTROL OBJECTIVES · TESTED OVER TIME — THE NET HOLDS

SOC 1 (SSAE 18) · Loan Servicing Industry

SOC 1 for Loan
Servicers

ICFR controls your investors and owners require. A comprehensive guide to SOC 1 attestation for loan servicers across auto, consumer, student, SME, and commercial lending — from payment application controls to custodial-account assurance and investor remittance.

Tranquility Cybersecurity has supported 100+ SOC 1 engagements for service organizations across lending, payments, and financial services — readiness through CPA examination.

Get a Loan Servicing SOC 1 Scoping Call Explore the SOC 1 Hub

100+SOC 1 engagements supported

5Countries served

SSAE 18AT-C 320 governed

AICPA SSAE 18 (AT-C 320) · ISAE 3402 internationally · Last reviewed June 2026

The Business Case

Why Loan Servicers Need SOC 1

Direct answer: Loan servicers process payments, calculate interest, manage delinquencies, and remit collections to the institutions that own the underlying loans. Every one of those activities directly affects line items on the owner's or investor's financial statements — interest income, loan receivables, allowance for credit losses, servicing-fee income, custodial liabilities, and charge-offs.

Under SSAE 18 (AT-C Section 320), when a user entity outsources a process that is relevant to its Internal Control over Financial Reporting (ICFR), that entity's external auditor must obtain assurance over the service organization's controls. A SOC 1 report — formally a “Report on Controls at a Service Organization Relevant to User Entities' Internal Control over Financial Reporting” — provides exactly that assurance. Internationally, the equivalent standard is ISAE 3402 issued by the International Auditing and Assurance Standards Board.

Without a SOC 1 report, each investor's or owner's auditor must either visit your facility to test controls directly — expensive and disruptive — or issue a scope limitation on the owner's financial-statement audit. Neither outcome is acceptable to institutional investors, warehouse lenders, or GSE counterparties, which is why a SOC 1 report has become a prerequisite for third-party loan-servicing contracts across auto, consumer, student, SME, and commercial lending. For mortgage-specific escrow controls, see our dedicated SOC 1 for Mortgage Servicers page.

Key Takeaways

Loan-servicing activities directly affect interest income, loan receivables, allowance for credit losses, and custodial liabilities on investor and owner financial statements.
SSAE 18 (AT-C 320) in the US and ISAE 3402 internationally are the governing standards. Both require an independent CPA to attest to your controls.
A SOC 1 Type II report — covering control operating effectiveness over 6-12 months — is what most institutional investors and warehouse lenders require.
CUECs define what loan owners and investors must do: provide accurate boarding data, review remittance reports, approve charge-offs, and reconcile custodial balances.

How Loan Servicing Affects Investor and Owner Financial Statements

Interest IncomeAccrued interest computed by the servicer flows to the income statement. Incorrect accrual rates or day-count conventions directly misstate revenue.
Loan ReceivablesPrincipal balances on the servicing system tie to the loan receivable balance on the owner's books. Misapplied payments distort this balance.
Allowance for Credit LossesDelinquency classifications and charge-off triggers feed the CECL or incurred-loss model. Incorrect bucketing understates or overstates credit reserves.
Servicing-Fee IncomeThe servicer deducts fees before remitting to owners. Incorrect fee calculations misstate the owner's net interest margin and servicing-expense line.
Custodial LiabilitiesBorrower funds held temporarily in custodial accounts are liabilities of the owner. Unreconciled custodial balances directly misstate the balance sheet.
Charge-offsCharge-off entries reduce loan receivables and draw down the allowance. Unauthorized or untimely charge-offs misrepresent asset quality and loss experience.

What Auditors Test

Loan-Servicing Control Objectives

The following control objectives are typical for loan service organizations across auto, consumer, student, SME, and commercial lending. Your CPA firm will tailor the exact objectives based on the asset classes and services you provide, but these six areas cover the core of what investor and owner auditors need to see.

Payment Processing & Application

Controls ensuring borrower payments are received, posted, and applied to principal, interest, and fees accurately and on time.

Receipt of payments via ACH, lockbox, card, wire, and mobile channels with same-day posting cut-off
Application of each payment to principal, interest, and fee balances per the contractual amortization schedule
Suspense-account controls — unidentified or partial payments segregated, investigated, and resolved within defined SLAs
Duplicate-payment detection and automated rejection or hold prior to application
End-of-day batch reconciliation of total payments received to general-ledger cash receipts

Interest & Principal Accrual

Controls over the accurate periodic computation of interest, maintenance of amortization schedules, and timely updates on rate-change events.

Daily interest accrual computations using the correct day-count convention (30/360, Actual/365, Actual/Actual) per loan type
Amortization-schedule maintenance: recalculation on any principal curtailment, deferral, or modification
Rate-change processing for variable-rate and index-linked loans (SOFR, MCLR, base rate): automated feed from approved rate sources
Accrual cut-off controls at period-end ensuring income is recognized in the correct accounting period
Reconciliation of accrued-interest balances on the servicing system to the general ledger monthly

Investor / Owner Remittance & Reporting

Controls over timely, accurate remittance of principal and interest to loan owners, investors, and warehouse lenders, together with servicing-fee calculation.

Calculation of pass-through P&I amounts per investor remittance instruction and pooling agreement
Servicing-fee deduction computed at the contractual rate before remittance, with supporting fee register
Dual-authorization requirement for remittance wire or ACH file release to investor settlement accounts
Monthly investor reporting (remittance statements, pool-level tape) delivered within contractual deadlines
Remittance reconciliation: cash transferred to investors reconciled to collections received less fees and permitted float

Delinquency & Default Management

Controls ensuring accurate delinquency-bucket classification, timely late-fee assessment, charge-off accounting, and collections-activity posting.

Automated delinquency-bucket assignment (30 / 60 / 90+ DPD) recalculated each business day
Late-fee assessment triggered at contractual grace-period expiry with borrower-notification controls
Charge-off authorization workflow requiring credit-committee or delegated-authority approval before write-down
Posting of collections activity (promise-to-pay, partial cures, payment plans) to loan history with agent identification
Reconciliation of charge-off entries to the allowance-for-credit-losses roll-forward each period

Custodial / Trust Account Management

Controls over the segregation, reconciliation, and disbursement of borrower funds held in custodial or trust accounts.

Legal segregation of custodial/trust accounts from operating accounts in the general ledger and at the bank
Daily reconciliation of custodial cash balance to borrower-level ledger detail, where variance thresholds trigger immediate investigation
Disbursement controls: payments out of custodial accounts (e.g., insurance premiums, tax disbursements) require authorized disbursement request
Unclaimed-funds identification and state-escheatment procedures per applicable dormancy statutes
Independent monthly review of custodial-account reconciliations by a function separate from cash posting

Segregation of Duties & Access Controls

Controls preventing any single individual from controlling the loan-servicing cycle end-to-end, and ensuring access to servicing systems is appropriate and periodically reviewed.

Separation of payment-posting roles from loan-balance adjustment and loan-modification authorization roles
System-enforced restrictions so users with investor-remittance release authority cannot also modify remittance instructions
Quarterly access recertification: managers attest to appropriateness of each direct report's servicing-system permissions
Logging and alerting on manual loan-balance overrides, interest waivers, and fee reversals above defined thresholds
Privileged-access reviews covering LOS, servicing platform, and data-warehouse environments at least semi-annually

From the Audit Floor

Common Audit Findings in Loan-Servicing SOC 1

These four findings appear repeatedly across loan-servicing SOC 1 engagements. Address them during the readiness phase to avoid exceptions in your report.

Misapplied or Unreconciled Payments

Payments received by ACH or lockbox are posted to the wrong loan account or left in suspense beyond the defined resolution window. When the servicing system and general ledger are reconciled, persistent suspense balances surface but root-cause investigation is incomplete.

Impact: Interest-income understatement or overstatement, borrower-account errors that cascade into incorrect delinquency bucketing, and an exception finding in the SOC 1 report.

Remediation: Enforce a 48-hour maximum suspense resolution SLA with automated escalation. Require daily reconciliation of suspense balances to zero (or documented exceptions) and include suspense aging in management reporting reviewed by a senior operations officer.

Incorrect Interest Accrual After a Rate Change

When an index rate (SOFR, MCLR, base rate) changes, the servicing system updates loan records in batch. Testing reveals a subset of variable-rate loans continued to accrue at the prior rate for one or more periods due to a system parameter error or manual-override list that was not cleared.

Impact: Misstatement of interest income and accrued-interest receivable on investor and owner financial statements, and potential regulatory compliance exposure for loans subject to consumer-protection rate-cap rules.

Remediation: Implement a post-rate-change validation report that compares the effective rate on every active loan in the rate-change cohort to the new index plus margin. Require a sign-off from a servicing operations manager before the next accrual cycle runs.

Custodial-Account Reconciliation Gaps

The custodial (trust) account reconciliation is performed monthly rather than daily, and the reconciler is the same person who posts cash. Unreconciled items older than 90 days are present, including a credit that has not been matched to a borrower account.

Impact: Segregation-of-duties exception, potential misappropriation risk, and a qualified opinion or adverse finding in the SOC 1 report that investor due-diligence teams will flag.

Remediation: Move to daily custodial reconciliation performed by a function independent of the cash-posting team. Establish a stale-item threshold (e.g., 5 business days) that triggers an automatic escalation to the controller and a formal investigation log.

Unauthorized Loan-Balance Adjustments and Terminated-User Access

Manual loan-balance adjustments (principal waivers, interest write-offs, fee reversals) are made without a documented authorization workflow. Separately, access reviews reveal that two former employees still have active accounts in the servicing platform 60+ days after their termination dates.

Impact: Fraud risk and unauthorized-modification exposure. Terminated-user access is a direct exception under most SOC 1 access-control objectives, and user-entity auditors raise ICFR deficiency for insufficient access governance.

Remediation: Implement a ticketing workflow for all manual adjustments requiring two-level approval (operations and credit/finance). Integrate the HR offboarding checklist with the servicing-platform provisioning system to disable accounts on the termination date, and run a monthly active-user-vs-HR reconciliation.

Client Responsibilities

CUECs for Loan Owners & Investors

Complementary User Entity Controls (CUECs) define the responsibilities your clients — loan owners, investors, and warehouse lenders — must fulfil for your controls to work as designed. Your SOC 1 report lists these explicitly so each client's external auditor can test them on the client side.

1

Provide Accurate Loan Terms & Boarding Data

The owner or investor must supply accurate loan terms (principal, rate, amortization type, payment frequency) at boarding. Errors in the original data tape propagate through every downstream control — payment application, interest accrual, and remittance calculations all depend on the servicer receiving correct source information.

2

Review Remittance Statements and Servicing Reports

Each reporting period, the owner or investor is responsible for reviewing the remittance statement, pool-level tape, and delinquency report for reasonableness. Unexplained variances should be communicated to the servicer promptly. Unreviewed reports indicate the CUEC has not been satisfied.

3

Approve Charge-offs, Modifications, and Loss-Mit Actions

Where the servicing agreement requires owner or investor approval before a charge-off, loan modification, or loss-mitigation action (forbearance, deferral, settlement), the owner must respond within the contractual authorization window. Delayed approvals can result in incorrect financial-statement presentation of delinquent assets.

4

Reconcile Custodial Balances to Internal Records

Owners and investors should reconcile the custodial-account balances reported by the servicer to their own internal records each month. This cross-check is a key detective control for any misposting or timing differences that the servicer's own reconciliation may not catch.

5

Notify Servicer of Rate, Regulatory, or Contractual Changes

If a benchmark index changes (e.g., a transition from LIBOR to SOFR), a new regulatory cap applies, or the pooling and servicing agreement is amended, the owner must notify the servicer in writing before the effective date. Late notice shifts the risk of system-update errors to the owner.

Best practice: Include a CUEC mapping table in your SOC 1 report and in investor onboarding materials so that finance teams and their auditors know exactly which controls sit on their side of the boundary. Poorly communicated CUECs are the most common source of friction during user-entity audits of loan servicers.

Dual-Report Strategy

SOC 1 + SOC 2 for Loan Servicing Platforms

If you deliver loan servicing through a cloud platform or borrower-facing portal, your prospects will likely ask for both reports. Each serves a different audience and purpose:

SOC 1 (ICFR)

Audience: Loan owners, investors, warehouse lenders, and their external financial-statement auditors
Focus: Controls relevant to financial reporting (interest income, loan receivables, charge-offs, custodial liabilities)
Standard: SSAE 18 (AT-C 320) / ISAE 3402
Tests: Payment application, interest accrual, remittance accuracy, custodial-account controls, delinquency classification

SOC 2 (Trust Services)

Audience: Borrower-facing product teams, CISOs, procurement, and IT security reviewers
Focus: Operational controls — security, availability, confidentiality, processing integrity, privacy
Standard: SSAE 18 (AT-C 205) / Trust Services Criteria
Tests: Access controls, encryption of borrower PII, uptime SLAs, incident response, data privacy

The efficiency argument: A coordinated dual-report engagement lets the CPA firm test overlapping controls once. General IT controls — access management, change management, incident response — are relevant to both reports, so a single audit can produce two reports at 30–40% less effort than running them independently.

Tranquility Cybersecurity's role: We handle the readiness, gap assessment, remediation, and evidence preparation for both reports. An independent CPA firm performs the attestation examination and issues the final SOC 1 and SOC 2 reports. This separation preserves auditor independence as required by professional standards.

SOC 1 Overview ICFR Controls Deep-Dive SOC 1 for Mortgage Servicers SOC 1 for Fintech SOC 2 Overview

Proof

In their words.

Quotes verbatim from G2. Company names added where the client confirmed them.

Verify on G2

They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.

Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026

Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.

Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026

The team’s willingness to work with us and ease of communication.

sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026

They delivered the project with speed, accuracy, and cost-effectiveness.

Maneet P.Mid-MarketSOC 2 · August 2026

My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.

Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026

They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.

Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026

Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.

Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026

Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.

Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026

The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.

Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026

What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.

Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026

Frequently Asked Questions

Common questions about SOC 1 for loan servicers — scope, control objectives, custodial accounts, timelines, costs, and CUECs.

Why do loan servicers need a SOC 1 report?

Loan servicers directly affect the financial statements of the loan owners and investors they serve. Payment collections flow into interest-income accounts, remittances reduce investor cash, charge-offs affect the allowance for credit losses, and custodial balances appear as liabilities. Under SSAE 18 (AT-C Section 320), when a user entity outsources a process relevant to its ICFR, its external auditors must obtain assurance over the service organization's controls. A SOC 1 report provides that assurance at scale, replacing costly on-site auditor visits for each investor or owner.

Should a loan servicer get SOC 1 Type I or Type II?

Type I confirms that your control descriptions are suitably designed at a point in time. Type II tests whether those controls operated effectively over a minimum 6-month observation period. Most institutional investors, warehouse lenders, and GSE counterparties require a Type II because it demonstrates sustained operating effectiveness. A practical path is to achieve Type I first (typically 6-10 weeks of readiness plus a one-day CPA examination) to identify any design gaps, then run the Type II observation window immediately after.

What control objectives does a loan-servicing SOC 1 typically cover?

The core six areas are: (1) payment processing and application to principal, interest, and fees, (2) interest and principal accrual including rate-change processing, (3) investor and owner remittance plus servicing-fee calculation, (4) delinquency and default management including charge-off accounting, (5) custodial and trust account controls including segregation and reconciliation, and (6) segregation of duties and access governance. The exact objectives are scoped with your CPA firm based on the asset classes and services you actually provide.

How does custodial / trust account assurance work in a SOC 1?

Custodial accounts hold borrower payments temporarily before they are disbursed to investors or applied to loan accounts. Because these funds are not the servicer's own money, the controls over segregation, reconciliation, and disbursement are treated as high-risk in a SOC 1 examination. The auditor will test that custodial accounts are legally separate from operating accounts, that daily reconciliations are performed by an independent function, and that stale items are investigated promptly. Gaps here are among the most common causes of qualified opinions in loan-servicing SOC 1 reports.

What are CUECs for a loan servicer, and who tests them?

Complementary User Entity Controls (CUECs) are responsibilities that the loan owner or investor must fulfil for the servicer's controls to achieve their stated objectives. Examples include providing accurate loan boarding data, reviewing remittance statements each period, approving charge-offs within contractual timelines, and reconciling custodial balances to internal records. The servicer's SOC 1 report lists these explicitly. Each investor's or owner's external auditor then tests the CUECs on the client side as part of their own ICFR assessment.

Does a loan servicer also need SOC 2 if it runs a borrower portal?

Yes — if you operate an online borrower portal, mobile app, or API that stores personal or financial data, your investors and regulators will likely ask for SOC 2 in addition to SOC 1. SOC 1 covers financial-reporting controls (ICFR), while SOC 2 covers operational and security controls under the Trust Services Criteria (security, availability, confidentiality, processing integrity, privacy). A coordinated dual-report engagement is efficient because general IT controls — access management, change management, incident response — are relevant to both reports and can be tested once.

What does a SOC 1 engagement cost for a loan servicer?

Cost depends on scope: number of asset classes serviced, geographic footprint, number of control objectives, and report type. At most firms there are two components: the CPA firm's attestation fee (typically $25K–$70K for a mid-size servicer in the US) and the readiness/advisory fee. Tranquility Cybersecurity provides readiness and remediation support for loan-servicing SOC 1 at a significant cost advantage versus US- or UK-based advisory firms, in one all-in fee of USD 4,500–5,500 (₹4–5 Lakh) that includes the independent CPA firm's examination. Contact us for an indicative quote scoped to your platform.

Keep Exploring

SOC 1 for Loan Servicers

Why Loan Servicers Need SOC 1

How Loan Servicing Affects Investor and Owner Financial Statements

Loan-Servicing Control Objectives

Payment Processing & Application

Interest & Principal Accrual

Investor / Owner Remittance & Reporting

Delinquency & Default Management

Custodial / Trust Account Management

Segregation of Duties & Access Controls

Common Audit Findings in Loan-Servicing SOC 1

Misapplied or Unreconciled Payments

Incorrect Interest Accrual After a Rate Change

Custodial-Account Reconciliation Gaps

Unauthorized Loan-Balance Adjustments and Terminated-User Access

CUECs for Loan Owners & Investors

Provide Accurate Loan Terms & Boarding Data

Review Remittance Statements and Servicing Reports

Approve Charge-offs, Modifications, and Loss-Mit Actions

Reconcile Custodial Balances to Internal Records

Notify Servicer of Rate, Regulatory, or Contractual Changes

SOC 1 + SOC 2 for Loan Servicing Platforms

SOC 1 (ICFR)

SOC 2 (Trust Services)

In their words.

Frequently Asked Questions

Related Reading

SOC 1 Knowledge Hub

SOC 1 for Mortgage Processing

SOC 1 for Fintech

ICFR Controls Guide

SOC 1 vs SOC 2

SOC 1 (ICFR)

Written By Expert Auditors

Get in touch

Send us your requirement.

Go deeper.

AT-C 320, Explained

SOC 1 Bridge Letters

SOC 1 Description Criteria

SSAE 18 vs SSAE 21

SOC 1 vs SOC 2 vs SOC 3

CUECs & CSOCs Explained

SOC 1 for Loan
Servicers