SOC reports (SOC 1 and SOC 2)
SOC reports are independent CPA reports on a provider’s controls: SOC 1 covers those relevant to your financial reporting, SOC 2 security and related areas.
SOC stands for System and Organization Controls: examinations CPAs perform under AICPA attestation standards at service organizations such as payroll processors. A SOC 1 report addresses controls likely to be relevant to your internal control over financial reporting, and it is intended for you and your financial-statement auditor. A SOC 2 report addresses one or more of security, availability, processing integrity, confidentiality, and privacy. Either can be Type 1, on control design at a point in time, or Type 2, which also tests operating effectiveness over a period.
Which SOC report should you ask a payroll provider for?
The right SOC report depends on who needs the assurance. Payroll feeds wage expense and tax liabilities in your financial statements, so your auditor may ask for the provider’s SOC 1, while a vendor-risk review usually asks for a SOC 2. A SOC 2 report is restricted to specified parties, such as customers who understand the provider’s system. Either way, check that the report’s scope covers the payroll service you use, how recent the report is, which exceptions the auditor found, and whether services the provider outsources are carved out.
| REPORT | CONTROLS IT EXAMINES | MAIN READER | STANDARD |
|---|---|---|---|
| SOC 1 | Controls relevant to your financial reporting | You and your financial-statement auditor | AT-C section 320 |
| SOC 2 | One or more of security, availability, processing integrity, confidentiality, privacy | Your security or vendor-risk reviewers | AT-C section 205 |
- Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting (SOC 1®) (2025)
- SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy
General information, not legal or tax advice. Apply current federal and state rules with qualified guidance.