SOC 1 and SOC 2 attestation readiness (Type I and Type II)
SOC 1 and SOC 2 reports give clients independent assurance on a service organisation's controls. Type I covers control design at a point in time; Type II also tests operation over a period. Reports are issued only by licensed CPA firms. ICFC prepares you through readiness assessments, control design, evidence preparation and training, and supports you during the CPA firm's examination.
Cybersecurity, IT and Data Protection
- Standard or scheme
- SOC 1 and SOC 2
- AICPA; reports issued by licensed CPA firms
- Type
- Attestation readiness
- Report issued by a licensed CPA firm
- Funding
- Not on the EDGE Standards list
- Non-grant engagement
What is SOC 1 and SOC 2?
SOC reports are independent attestation reports on the controls of a service organisation, issued by licensed CPA firms under AICPA standards.
A SOC 1 report covers controls that matter to clients' financial reporting. A SOC 2 report covers controls for security, availability, processing integrity, confidentiality and privacy, using the AICPA Trust Services Criteria. A Type I report looks at whether controls are suitably designed at a point in time. A Type II report also tests whether they operated effectively over a review period agreed with the CPA firm, commonly three to twelve months.
Who is SOC 1 and SOC 2 for?
Service organisations such as SaaS, cloud, managed IT, payroll, fund administration, payment and outsourcing providers whose clients, or their clients' auditors, ask for a SOC report.
Key details
SOC 1 or SOC 2?
Choose SOC 1 when your service affects your clients' financial statements, such as payroll, billing or fund administration. Choose SOC 2 when clients care about how you protect and run their systems and data. Some organisations need both.
Type I or Type II?
A Type I report is quicker and suits a first report or a new service. Most enterprise buyers ask for Type II, because it shows controls working over time. Many organisations start with Type I and move to Type II for the next period.
Independence
AICPA independence rules limit how far a CPA firm can help design the controls it then reports on. Keeping readiness work with ICFC and the examination with an independent CPA firm keeps both roles clean. With your agreement, we share the readiness file with your chosen firm.
Singapore financial sector
Outsourced service providers to Singapore banks may be asked for an OSPAR report under the Association of Banks in Singapore guidelines, performed by auditors on the ABS list of qualified auditors. We map OSPAR, SOC 2, ISO/IEC 27001 and Cyber Trust controls so evidence is reused.
Names and logos
ICFC uses the SOC names descriptively and does not display AICPA SOC logos. Your CPA firm can tell you how its report may be shared and described.
No grant found when checked - Non-grant engagement
We did not find this framework on the EDGE Standards list when we checked, so we quote it as a non-grant engagement. Check Enterprise Singapore before you assume any grant support.
Impartiality
Impartiality comes first. Every engagement begins with a conflict-of-interest check. We keep consulting and auditing roles separate, and our auditors never audit, on behalf of a certification body, an organisation that ICFC has consulted on the same scope within the period set by that body.
Our certification role
We do not certify organisations ourselves; certificates are issued by accredited certification bodies or scheme owners.
How we help
Who issues the report
SOC 1 and SOC 2 reports are issued only by licensed CPA firms under AICPA attestation standards. ICFC is not a CPA firm and does not issue SOC reports or opinions. In Singapore, public accounting firms may also report on service organisation controls under SSAE 3402 or the international ISAE 3402.
Readiness assessment
A first-party review of your system description, control objectives or Trust Services Criteria, and evidence, run like a Type I walkthrough, with a prioritised gap list before you engage the CPA firm.
Second-party reviews
Reviews of your own vendors' SOC reports: scope, exceptions, subservice organisations and the complementary user entity controls you are expected to operate.
Funding
We explain which scheme, if any, applies and what it requires before you commit.
Non-grant
A fixed-scope engagement: gap assessment, documentation, implementation coaching, internal audit and management review, and support through the formal audit or assessment.
How we work
Practical, proportionate systems that your staff can run after we leave.
Classroom
Public and in-house classroom sessions. Courses on SOC 1 and SOC 2: awareness for control owners, readiness and evidence preparation, and how to read and use vendor SOC reports.
Online LMS
Self-paced and live-online courses on the ICFC Digital LMS, with progress tracking and certificates of completion.
Funding
Funding depends on each course's approval status, shown on the course page in the LMS.