SSAE 18 SOC 1 Attestation — DC, Maryland & Virginia

SOC 1 Audit (SSAE 18) for Service Organizations — DC, Maryland & Virginia

AICPA-standard AT-C 320 reports for payroll processors, benefit administrators, loan servicers, and service organizations. When your clients' auditors ask for your controls report, we make sure you're ready.

Send a message

What is a SOC 1 audit and when is it required?

A SOC 1 audit (SSAE 18 AT-C 320, formerly SAS 70) examines a service organization's internal controls over financial reporting (ICFR). It is required when a service organization processes transactions that affect their clients' financial statements — common for payroll processors, benefit administrators, loan servicers, transfer agents, and data centers. User entity auditors request SOC 1 reports when auditing clients that rely on these service organizations.

Why Service Organizations Need a SOC 1 Report

Your client's auditor is requesting your SOC 1 report and you don't have one — threatening the client relationship

You're a payroll processor or benefits administrator and prospects are asking for your controls report

Your SOC 1 report expired and you need to renew before your clients' year-ends

You had a SAS 70 report years ago and need to convert to modern SSAE 18 SOC 1 format

Key Terms

SSAE 18: Statement on Standards for Attestation Engagements No. 18 — the AICPA standard governing SOC 1 (AT-C 320) and SOC 2 (AT-C 205) reports. Replaced SSAE 16 and SAS 70 in 2017.

User Entity: The client organization that uses the service organization's services. User entity auditors request SOC 1 reports to understand controls at the service organization that may affect the user entity's financial statements.

SOC 1 Attestation Services

Complete SSAE 18 SOC 1 engagements from readiness through annual re-audit.

SOC 1 Readiness Assessment

Gap analysis of your current controls against the control objectives you'll include in the report. Identifies documentation gaps and control weaknesses before fieldwork begins.

Type I Report (SSAE 18 AT-C 320)

Point-in-time CPA opinion on whether your controls are suitably designed to achieve control objectives. Faster than Type II — no observation period required.

Type II Report (SSAE 18 AT-C 320)

6-12 month operating effectiveness testing. The standard required by most user entity auditors. Includes testing procedures, results, and the CPA's opinion on effectiveness.

Control Remediation

Guidance on fixing control gaps identified during readiness assessment or fieldwork. We help you implement controls before they appear as exceptions in the final report.

Annual Re-audit

Ongoing SOC 1 Type II audits to maintain currency. SOC 1 reports cover a specific period — most user entities require a current report that covers your most recent fiscal year.

SOC 1 Type I vs Type II — Key Differences

Feature	SOC 1 Type I	SOC 1 Type II
What it covers	Controls designed appropriately at a point in time	Controls operated effectively over an observation period, usually several months
Opinion standard	Suitability of design	Operating effectiveness
Typical use	First-year report; new service organizations	Ongoing annual requirement; most user entities require Type II
Timeline	Depends on how ready your controls are	Includes an observation period, usually several months
User entity acceptance	Limited — some accept for first year only	Broadly accepted; required by most auditors

SOC 1 Engagement Process — 4 Steps

Scoping

Identify which financial reporting controls are in scope based on services provided to user entities. Define the control objectives that will be included in the report.

Readiness Assessment

Gap analysis against control objectives. Identify what's documented vs. missing. Provide a remediation roadmap before the observation period or Type I testing begins.

Type I or Observation Period

Either point-in-time testing (Type I) for immediate documentation, or 6-12 month effectiveness testing (Type II) for the comprehensive report most auditors require.

Report Issuance

CPA issues the SSAE 18 AT-C 320 report. You distribute to user entities and their auditors as needed — and to prospects during the sales process.

Related Services

SOC 2 Audit (SSAE 18)

Security and data protection controls for SaaS and tech companies.

Attestation Services

AUPs, reviews, compilations, and other SSAE 18 engagements.

Government Contractor Audit

DCAA compliance and incurred cost submissions.

Employee Benefit Plan Audit

DOL-required audits for 401(k) and pension plans.

Audit, Review & Compilation

Full-service audit and assurance overview.

Free consultation

Talk to a SOC 1 specialist about your situation.

SOC 1 Audit FAQs

Common questions from service organizations and their finance teams about SSAE 18 SOC 1 reports.

SSAE 16 replaced SAS 70 in 2011. SSAE 18 (AT-C 320) replaced SSAE 16 in 2017. If you have an old "SAS 70 report," you need an updated SOC 1 under SSAE 18.

User entity auditors (CPAs auditing companies that use your services) typically request SOC 1 reports. They need to understand your controls when auditing their clients' financial statements.

Payroll processors, benefit plan administrators, loan servicers, insurance claims processors, transfer agents, data centers hosting financial systems, and any service organization processing financial transactions for clients.

SOC 1 covers controls over financial reporting (ICFR). SOC 2 covers operational controls (security, availability, privacy). A payroll processor typically needs both — SOC 1 for the financial processing controls and SOC 2 for data security.

A SOC 1 Type II engagement has three parts: a readiness assessment, an observation period and report issuance. The observation period is usually several months, set by you and your report users. How long readiness and reporting take depends on how mature your controls are and how quickly evidence is available. We agree on a schedule with you before testing starts.

Yes. Type I provides immediate documentation and is faster. You can begin the Type II observation period concurrently or immediately after Type I.

A specific statement about what a control is designed to achieve (e.g., "Controls provide reasonable assurance that payroll transactions are authorized, calculated accurately, and processed timely"). The CPA tests whether controls meet these objectives.

User entity auditors use SOC 1 Type II reports (specifically the complementary user entity controls and the description of control objectives) to assess audit risk and reduce the testing they need to perform at their client's location.

Client Auditor Requesting Your SOC 1? We Can Help.

Whether you need a Type I report quickly or a comprehensive Type II engagement, we scope a clearly-priced SOC 1 that meets your users' auditors' requirements.