A Systems and Organisational Controls (SOC) report provides independent assurance over an organisation’s control environment.

A SOC report helps demonstrate that appropriate controls are in place to manage risk, support good customer outcomes, and build confidence among stakeholders. They are often requested by investors, clients, or other third parties as part of a due diligence or review process to assess both the design and operating effectiveness of an organisation’s control framework.

They are typically obtained by businesses that deliver outsourced services, handle client assets, or operate critical systems on behalf of institutional, regulated, or international clients.

In this article, we answer the key questions surrounding SOC reports, explain what a SOC report is, who may need one, and what is involved in obtaining one.

Why might you obtain a SOC report?

SOC reports are widely regarded as a leading form of third-party assurance. Demand is usually driven by a client, investor, auditor or other stakeholder request. In practice, organisations usually choose to obtain a SOC report when the commercial risk of losing (or failing to win) business outweighs the cost and effort of reporting. This is particularly relevant where clients or investors require independent assurance as part of onboarding, due diligence, or ongoing oversight.

You might undertake a SOC report when you are looking to:

• Demonstrate a commitment to strong governance and control environments, helping to build trust with clients, prospects, and other stakeholders.

• Give stakeholders confidence that critical processes and controls are working as intended to safeguard data, support reliable systems and operations, and manage key risks.

• Streamline assurance processes through a ‘test once, share many’ approach, reducing the audit burden and saving valuable time and resources.

Are SOC reports mandatory in the UK?

There is no statutory requirement to obtain a SOC report in the UK.

While SOC reporting is not a regulatory requirement, it can however support organisations in meeting expectations relating to outsourcing and third‑party risk management.

For example, under Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) requirements, firms are expected to maintain effective oversight of outsourced arrangements and obtain appropriate assurance over service providers. SOC reports are commonly used as part of this approach, providing independent assurance over the design and operating effectiveness of controls. However, they typically form part of a broader due diligence and oversight framework.

Is demand for SOC reporting increasing?

Yes, demand for SOC reports is increasing.

As organisations become more reliant on outsourced service providers and cloud-based technologies, there is a growing need for independent assurance over the controls supporting critical systems and business processes. At the same time, regulators are placing greater emphasis on managing third-party risk, while investors, customers, and auditors are applying increased scrutiny to service organisations and their control environments. As a result, SOC reports have become an important tool for demonstrating transparency, providing assurance over key controls and building stakeholder confidence.

Who might need a SOC report?

Organisations are commonly asked to provide a SOC report where they:

• Deliver outsourced or regulated services.

• Handle client assets or data.

• Operate critical systems.

This is particularly relevant for organisations such as:

• Financial services and outsourced operations: Custody; fund accounting and transfer agency; investment, asset and fiduciary management; pension administration; private equity and real assets; property investment management and administration; mortgage, loan and credit processing and servicing; payroll and payment processing; third-party administration (TPA), and outsourced back-office functions.

• Technology and platform providers: Fintech and digital platforms; SaaS, cloud and IT infrastructure solutions; data, cybersecurity, and hosting services.

What does a SOC report include?

SOC reports are usually structured as follows:

1. Introduction

2. Management statement

3. System description

4. Control objectives and control activities

5. Testing results

6. Audit report

7. Other information provided by management (optional, and typically included if exceptions or subsequent events have been noted)

What are the different types of SOC reports?

SOC reports originate from the AICPA framework under SSAE 18. However, the term ‘SOC’ is widely used in practice outside of the US to refer more broadly to SOC and SOC-equivalent reports.

What’s the difference between a SOC 1 and SOC 2 report?

SOC (and SOC-equivalent) reports can be broadly categorised into two types – the key difference being the subject matter of the controls being assessed.

SOC 1 (or equivalent): Operational and financial reporting controls

• Assurance over the controls that support accurate financial reporting and transaction processing.

• These reports are typically relevant to services that could affect the financial reporting of a user organisation.

• The relevant standards for these reports include: AAF 01/20 (UK), ISAE 3402 (international), SSAE 18 (US – e.g. SOC 1 report).

SOC 2 (or equivalent): Trust, security and data protection controls

• Assurance over the controls that support information security and data protection, including the ‘Trust Services Criteria’ being security, availability, confidentiality, processing integrity, and privacy.

• These reports are typically relevant for IT, data and platform-based services.

• The relevant standards for these reports include: ISAE 3000 (international - e.g. ‘SOC 2-aligned ISAE 3000 report), SSAE 18 (US – e.g. SOC 2 and SOC 3 reports).

What is a SOC 3 report?

A SOC 3 report is based on the same underlying assurance as SOC 2 but is specifically designed to be made publicly available. While a SOC 2 report is intended to be for restricted use by clients, investors and auditors, a SOC 3 report is a high-level version of the report, produced for general use and can be made available on your company website or shared for public distribution.

What’s the difference between a Type 1 and Type 2 report?

Type 1: Assurance is obtained over the design and implementation of controls at a specific point in time.

Type 2: Assurance is obtained over the design, implementation, and operating effectiveness of controls over a defined period of time.

Both SOC 1 and SOC 2 reports can be issued as either a Type 1 or Type 2 report.

What are the standards used for SOC reporting?

While SOC reporting standards vary by jurisdiction, they are broadly aligned in their objectives and methodology. Although the underlying frameworks may differ, they generally follow a consistent methodology for evaluating controls and reporting findings to stakeholders.

What standards underpin SOC reporting globally?

SOC reports are built on established assurance standards and control frameworks recognised around the world.

They can be grouped according to the type of controls being assessed:

Operational and financial reporting controls

These focus on controls relevant to transaction processing and financial reporting.

• UK: AAF 01/20 - issued by the ICAEW.

• International: ISAE 3402 - issued by the IAASB.

• US: SSAE 18 (SOC 1 reports) - issued by the AICPA.

Trust, security and data protection controls

These focus on the ‘Trust Services Criteria’, including security, availability, confidentiality, processing integrity, and privacy.

• International: ISAE 3000 (e.g. ISAE 3000 using the ‘Trust Services Criteria’ often referred to as a ‘SOC 2-aligned ISAE 3000 report’) - issued by the IAASB.

• US: SSAE 18 (SOC 2 reports issued using the ‘Trust Services Criteria’) – issued by the AICPA.

How do SOC reporting standards compare?

In practice, SOC reports issued under different standards are broadly aligned in objectives, though differences in format, terminology, and regional acceptance mean stakeholder requirements should be considered carefully.

The choice of standard is typically driven by your primary market or stakeholder requirements, rather than any fundamental difference in the level of assurance provided. It’s important that you go down the route of having the specific report your stakeholders have requested. Guidance for this can be provided and we can help you to understand the options available to you, so you are able to choose the standards that align most with your requirements.

What does the SOC reporting process look like?

Our assurance reporting service follows a rigorous process. We work through the process with you collaboratively, providing ongoing support and guidance to help you reach the end goal of obtaining an independent assurance report which can then be shared with third-parties.

We go through the following steps:

1. Readiness assessment – to evaluate how prepared you are for a controls assurance report.

2. Remediation (if required) – to address gaps and enhance your control environment.

3. Type 1 report – providing assurance over the design and implementation of controls at one specified point in time.

4. Type 2 report – extending assurance to include the operating effectiveness of controls over a defined period.

5. Ongoing assurance – typically, a Type 2 report will then be completed annually.

How long does a SOC report take to complete?

The whole process typically takes between three and six months from planning through to completion. This includes planning and ‘point in time’ evidence collection before the period-end, followed by fieldwork and report completion after the period-end. We aim to deliver the final report within two to three months of the period/year-end. Reporting timescales will depend on maturity of your control environment, the state of controls assurance readiness at the outset, and the quality of evidence provided. First time reporting is likely to take longer, particularly where a readiness assessment or remediation is required before the assurance period begins.

How often do you need a SOC report?

A Type 2 report would typically be performed annually. For a first reporting period it is not uncommon to have a shorter reporting period to satisfy a demand from an external stakeholder. Three months is commonly used as a practical minimum reporting period, though this can depend on auditor judgement.

How much does a SOC report cost?

The pricing of a SOC report is dependent on a number of factors, including the scope of the engagement, the complexity and maturity of the control environment, the volume of controls in place, and the level of activity being tested. Each organisation is different, so costs will be tailored to your individual organisation.

What level of effort is required from management to obtain a SOC report?

One of the most common concerns when undertaking a SOC audit is the amount of time required from management and operational teams. While some involvement is necessary, the level of effort will depend on the maturity of your existing control environment and current documentation. Typically, management will need to support with:

• Documenting key controls and processes.

• Preparing the system description.

• Participating in control walkthroughs with the auditors.

• Providing evidence to demonstrate that controls are operating effectively.

With appropriate planning, management involvement can be kept to a minimum, allowing teams to remain focused on day-to-day priorities.

How can I use my SOC report?

Are SOC reports publicly available?

SOC reports are not typically made publicly available. They are restricted-use documents and are shared on a confidential basis with relevant stakeholders, such as clients, investors, and auditors. Access is usually controlled by the issuing organisation and may require a non-disclosure agreement (NDA).

This controlled distribution helps organisations balance transparency with security, while still providing stakeholders with the assurance they require.

The exception to this is SOC 3 reports which are based on the underlying controls and assurance work from a SOC 2 report but contain less detail and are suitable for public distribution.

What are the key benefits of SOC reports?

The key benefits of a SOC report extend beyond the independent assurance opinion. By demonstrating that controls have been rigorously assessed, organisations can increase trust and credibility with customers, investors, regulators, and other stakeholders. SOC reports provide a competitive advantage, by helping businesses differentiate themselves in the marketplace, and streamlining client due diligence processes, thereby supporting both client retention and future growth opportunities.

At Buzzacott, we deliver high‑quality reporting services across the financial services, technology, and real estate sectors, helping organisations meet their controls assurance obligations. We deliver a pragmatic, efficient assurance process that is designed to satisfy stakeholder expectations, while providing meaningful insights that add value.

If you are interested in obtaining a SOC report for the first time, or looking for a new provider, we would be delighted to support you. Contact our team using the form below.