SOC 1 and
SOC 2 reports.

For SaaS companies, technology providers, and service organizations.

Reports and scope

SOC 2

System and data controls

An examination of controls relevant to security and, as applicable to your scope, availability, processing integrity, confidentiality, and privacy.

Examples include SaaS platforms, cloud hosting, and managed IT services.

Request a SOC 2 proposal
SOC 1

Financial reporting controls

An examination of controls at a service organization that are relevant to its customers’ internal control over financial reporting.

Examples include payroll and transaction processing services.

Request a SOC 1 proposal

Type 1 and Type 2

The report type determines the period and testing covered by the examination.

Design at a point in time.

A Type 1 report addresses the design of controls as of a specified date.

Explore the AICPA’s SOC resources

Engagement process

  1. 1

    Define the engagement

    Align on your services, customer requirements, system boundaries, and report type.

  2. 2

    Plan the evidence

    Understand your controls and agree on requests, responsibilities, and timing.

  3. 3

    Examine the controls

    Work directly with us through testing, questions, and discussion of findings.

  4. 4

    Complete the report

    Review the results and finalize the report for its intended users.

Our partners

Jason Brett, partner at Periscope Advisory Group

Jason Brett

CPA, CISA, CITP

Jason brings more than 20 years of experience across technology risk, SOC reporting, and cybersecurity, including practice leadership at Elliott Davis and earlier roles with Truist, Wells Fargo, and Deloitte.

Brody Ledbetter, partner at Periscope Advisory Group

Brody Ledbetter

CPA, CISA, CRCM

Brody has nearly a decade of experience in public accounting, internal audit, controls, and regulatory compliance. As a former Internal Audit Practice Leader at Elliott Davis, he led outsourced and co-sourced engagements across the country.

Request a
SOC proposal

Tell us about your company, report requirements, and timing. A partner will respond.

Email the partners