Detailed Section-by-Section Evidence Requirements
Unlike a SOC 2 audit which focuses on security, a SOC 1 audit centers on the integrity of processing systems that impact your customers' financial statements. You must prove control consistency over the review period.
1. Transaction Processing & Accuracy
- Processing Verification: Maintain records of system-generated batch counts, hashing totals, or reconciliation logs proving inputs match outputs daily (e.g., verifying 10,000 billing records ingested match 10,000 invoiced).
- Exception Resolution: Keep documentation showing how system errors or processing failures were investigated, corrected, and approved by a manager before reprocessing.
2. Billing, Revenue & Reconciliation
- Contract Reconciliations: Provide a sample of weekly or monthly reconciliation checklists showing that actual billed amounts were matched against customer contracts, highlighting a designated manager's sign-off.
- Adjustment Authorizations: Maintain signed approval forms, tickets, or system workflow logs for all adjustments made to ledger records, credit notes, or custom fee overrides.
- Bank Sign-offs: Produce PDF copies of monthly bank reconciliations, showing that general ledger totals were matched to bank statements and that any variances were resolved within policy windows.
3. Segregation of Duties (SoD)
- System Permissions Matrix: Provide an access control list (ACL) mapping user accounts to roles. Show that personnel in payment-handling roles (AR/AP) cannot update supplier lists, configure billing rules, or modify their own transactions.
- Production Access Boundaries: Show that your engineering team does not have administrative access to the live billing database or financial databases. Implement an approval-gated read-only tunnel if debug access is required.
4. IT General Controls (ITGC) for Financial Systems
- Role-Based Access: Provide configuration evidence of role-based permissions in your core billing platform (e.g., Stripe, Chargebee) and ERP system (e.g., NetSuite, QuickBooks Online).
- Backup Restoration Records: Provide evidence of an annual restore test specifically for the financial database, confirming data was successfully restored to a temporary environment and verified by the accounting lead.
Startup Case Study: Springfield Billing API
Background: A 45-employee SaaS platform providing automated subscription billing APIs was required by their publicly traded clients to deliver a SOC 1 Type II report to support their annual Sarbanes-Oxley (SOX) audits.
Implementation: The startup established strict automated validation checks inside their API ingestion layer. They restricted database access so that developers could check code in via GitHub, but had zero access to the production database environment. The finance team set up an automated reconciliation script to cross-examine daily credit logs against Stripe transfers, sending automated alerts to a Slack channel for manual review if discrepancies exceeded $0.01.
Audit Result: The independent CPA firm evaluated their controls over a 6-month period and issued a clean opinion with zero exceptions, noting their robust segregation of duties and automated transaction trails.
Common Auditor Findings & How to Avoid Them
Common Gaps:
- Inadequate Dual Authorization: Allowing a single administrator to create a vendor profile and approve a cash payment to that vendor. You must split these workflows.
- Lack of ITGC Scope: Focusing heavily on financial spreadsheets while neglecting the security of the servers hosting the billing software. Financial databases must be subject to security controls.
- No Documentation on Discrepancies: Resolving reconciliation issues verbally without recording the investigation steps, date, and final reconciliation journal adjustment.