SOC 1 (SSAE 18 / ISAE 3402) — Gap Analysis
AICPA SSAE 18 / ISAE 3402 — Internal Control Over Financial ReportingAbout SOC 1 (SSAE 18 / ISAE 3402)
SOC 1 is a service organisation control report focused on Internal Control over Financial Reporting (ICFR). It is governed by SSAE 18 (AICPA, US) and ISAE 3402 (IAASB, international). User entities and their financial auditors rely on SOC 1 reports to assess controls at service organisations that impact their financial statements. Type I covers design at a point in time; Type II covers design and operating effectiveness over a period (typically 6–12 months).
Issuing Body
AICPA (US — SSAE 18) / IAASB (International — ISAE 3402)
Edition
2017
Coverage
Internal Control over Financial Reporting (ICFR) at service organisations whose services affect their customers’ financial statements.
Typical Users
Service organisations whose services affect user-entity financial reporting — payroll providers, claims processors, fund administrators, custodians, transaction processors, cloud accounting platforms.
How to use this tool
1. Work through each clause. For each requirement, choose Compliant, Partial, Non-compliant, or leave as Not assessed.
2. Add notes against any requirement to record evidence, gaps, or corrective actions.
3. Click Save progress — data is stored locally in your browser, never uploaded.
4. Export the report as TXT, CSV, JSON or print to PDF for your audit file.
Note: This tool is a guided self-assessment. It does not replace a third-party audit and the authoritative version of the standard must be obtained from the issuing body.
ISO Xpert — Get in touch
UK-based consultancy specialising in management-system gap analysis, training and certification preparation across ISO, API, Halal, GFSI, ESG, cybersecurity and industry-specific standards.
Phone / WhatsApp
Office
71-75 Shelton Street, Covent Garden, London WC2H 9JQ, UK