Nonprofit Blog

This article focuses on how to address the carveouts of subservice organizations in a SOC 1 report (Service Organization Controls Report). SOC 1 reports cover key controls at the organizations that provide various services to the benefit plan (e.g., payroll providers, recordkeepers, custodians, etc.). These reports should be obtained and reviewed by the plan sponsor so they understand the systems in place at the service organization, including key controls that address financial statement assertions. The reports are also generally used by the auditor for performing the plan audit. We have found carve-outs of subservice organizations within the SOC 1 report (and how best to address them) to be a common hurdle in using the SOC 1 report effectively.