Here is the honest situation. A SOC 1 report under SSAE 18, or its international equivalent ISAE 3402, gives user entities and their auditors assurance over a service organization's controls relevant to their financial reporting. Preparing for it means defining the scope and control objectives, a fairly presented system description with a management assertion, suitably designed controls that operate over the period for a Type II, complementary user and subservice controls, and supporting an independent service auditor's examination. Doing that and evidencing it is real work, and a service organization with an overstated description or controls that lapse over the period is exactly where service organizations fall short.
This Kit removes the guesswork. It is every step of a SOC 1 or ISAE 3402 examination written as an adopt-ready control you personalize in a weekend, with the evidence a service auditor examines.
What you get, the moment you buy
Grounded in SOC 1 under SSAE 18 and the international standard ISAE 3402, with the scope and report type, the control objectives and system description, control design and operating effectiveness, complementary user and subservice controls and the examination and report called out. Editable Word and Excel files.
What one control looks like
This is defining the scope of the report, where SOC 1 preparation begins. All 18 are built to this depth.
Why this is not another template pack
- The evidence is the point. A control you cannot evidence over the period is an exception. This tells you what a service auditor examines and where service organizations fall short, for every step.
- Objectives, description and testing built in. The control objectives, the fairly presented system description and the operating-effectiveness evidence are written into the controls, the substance of the examination.
- Built on a mapped compliance corpus, not one person's opinion, from a graph of thousands of controls across standards.
- It compounds. SOC 1 and ISAE 3402 are the same examination under different standards, and they connect to SOC 2 and ISAE 3000, so this work feeds your wider assurance program.
Who buys this
Service organizations whose services affect user entities' financial reporting, and the compliance, finance, IT and audit leads who own the SOC 1 or ISAE 3402 report. Whether it is a first examination or an annual cycle, you save weeks and walk in with the objectives, description and evidence structured.
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
Is SOC 1 the same as ISAE 3402? They are the equivalent examination under the US (SSAE 18) and international (ISAE 3402) standards. This kit prepares you for both.
Does it cover Type I and Type II? Yes. Choosing the report type and, for Type II, demonstrating operating effectiveness over the period are built as controls.
Does it cover subservice organizations? Yes. The inclusive and carve-out methods and complementary subservice controls are built as controls.
What if it is not for me? A 30-day money-back guarantee.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com