SOC report registration

A SOC report is written by an independent CPA firm about the controls of a service organisation, such as a company that processes data or payments for its customers.

• A SOC 1 report covers controls relevant to customers' financial reporting; a SOC 2 report covers controls for security and, where included, availability, processing integrity, confidentiality and privacy.
• A Type 1 report describes the controls as of one date; a Type 2 report also tests how they operated over a period.

IUCB records that the CPA firm named on the registration issued the report, for the service organisation, report type and period stated. The registration gets its own number, starting with IUCB-SOC-, and a registration document with a QR code.

A registration is valid until 12 months after the end of the period the report covers (for a Type 1 report, after its as-of date). It can be suspended or withdrawn, and the record shows that as soon as it is decided.

The report is the CPA firm's attestation and is confidential; IUCB does not certify or accredit the service organisation.

IUCB does not audit the service organisation or test its controls, and it never publishes the report, its opinion or the firm's findings. To read the report itself, ask the service organisation.

Enter the IUCB-SOC- number on the verification page, or scan the QR code on the registration document. Numbers are matched whole: the record shows that one registration, and there is no public list.

CPA firms register reports through their own IUCB account, by invitation. To ask about registering a report, write to us.