-
×
ISO 45001 Assessment Tool - Ultimate Solution
1 × $19.00
Subtotal: $19.00
ISO 45001 Assessment Tool - Ultimate Solution
1 × $19.00 Subtotal: $19.00
SOC 1 Toolkit: 87 editable SOC 1 / ISAE 3402 templates built on AT-C section 320 — management’s system description in every required section, 19 control objectives with 76 risks and 77 illustrative controls, CUEC and CSOC registers, type 1 and type 2 assertions, the representation-letter checklist and a bridge letter — plus 6 documents for user entities reviewing a vendor’s report. Instant download.
$99.00
✓ In stock — instant download after checkout
A SOC 1 report has three parts, and management writes two of them. The service auditor examines management’s description of the system and management’s assertion; it does not write either. A first engagement turns on whether that description exists, and a folder of policies is not one.
The SOC 1 Toolkit is organised on the service organisation’s own obligations under AT-C section 320 (SSAE No. 18, as amended) and ISAE 3402: 87 editable templates, 63 Word documents and 24 Excel workbooks, across 9 sections. Every document carries a Requirements-addressed table naming the paragraphs it answers, and the crosswalk workbook lists all 82 identifiers — 41 from AT-C 320, 39 from ISAE 3402 — against the document that answers each.
The description criteria require eight elements, plus the changes during the period for a type 2 report, plus the rule that nothing relevant is omitted or distorted. The SOC 1 Toolkit gives you a master template with every element as a headed section.
A separate drafting template covers each element: services and classes of transactions; the transaction-processing narrative from initiation to reporting; the information the procedures use; significant events other than transactions; report preparation; subservice organisations and the carve-out or inclusive method; the control environment and the other COSO components; and the changes-during-the-period section built from a change log kept through the year.
A drafting standard sets the writing rules a user auditor needs — role by title, frequency stated, action on exception named — and a self-assessment tests the finished description against every criterion before the auditor sees it.
The commonest reason a SOC 1 examination goes wrong is an objective a user auditor cannot conclude on. The SOC 1 Toolkit’s objective library carries 11 business-process objectives and 8 IT general control objectives, each written to the four attributes the AICPA’s management guidance names — relevant to user entities’ financial-statement assertions, objective, measurable and complete — and each tied to the assertions it serves.
Under every objective sit the risks that threaten it, 76 in all with the fraud-relevant ones flagged, and 77 illustrative controls that each state the five things a user auditor looks for: frequency, responsible role, activity, information source and action on exception. Tailoring notes cover 7 types of service organisation, from payroll processors and fund administrators to claims administrators, payment processors, loan servicers, hosted financial applications and data centres. A reasonableness review with worked rewrites catches the objectives that fail.
A control objective that depends on something a user entity or a subservice organisation does is not achieved by the service organisation alone, and a report that leaves the dependency out claims a control the organisation does not operate. The SOC 1 Toolkit ships a complementary user entity controls register with 10 worked CUECs and a drafting guide that tests whether a contractual responsibility is really a CUEC; a complementary subservice organisation controls register with 8 worked CSOCs; the dependency test that decides whether a provider is a subservice organisation or a vendor; the carve-out versus inclusive decision memo; and the agreement a subservice organisation signs to be included.
ISAE 3402 has no term for complementary subservice organisation controls. The SOC 1 Toolkit says so, and its description wording introduces the concept for an ISAE reader rather than assuming it.
The SOC 1 Toolkit gives you the written assertion for a type 1 report, for a type 2 report and for the inclusive method with the subservice organisation’s own assertion, each in the structure both standards illustrate, with every criterion listed and a consistency check that catches a scope sentence that differs between the assertion and the description.
The representation-letter preparation checklist lists every representation the auditor will ask management to sign — the union of the AT-C 320 and ISAE 3402 lists — with the evidence behind each and the date rule. Subsequent events, the unaudited Other Information section, the draft-report review with the response to a modified opinion, report issuance and distribution, and the bridge letter that covers the gap to a user entity’s year end are each a document.
A type 2 assertion needs a reasonable basis management built itself; the auditor’s work is not it. The SOC 1 Toolkit carries the management testing plan, sampling guidance stated as the organisation’s chosen approach rather than as a rule of either standard, a test workpaper seeded with all 77 controls, an evidence-retention and request list with an information-produced-by-the-entity sheet, the population-completeness checklist, a deviation register classified the way AT-C 320 classifies deviations, a remediation tracker, the monitoring procedure and a quarterly control-owner attestation, so that the year-end assertion is built from four quarters of specific confirmations.
The 16 control policies and procedures in the pack are the ITGC and transaction-process controls a SOC 1 examination tests — logical access, provisioning, access review, privileged access, change management, program development, computer operations, backup, incidents, physical security, data transmission, client onboarding and authorisation, reconciliation and output review, IPE reliability, and competence of control performers — plus a segregation-of-duties matrix with 20 conflict pairs. They are written for internal control over financial reporting, not as a general security policy set.
The SOC 1 Toolkit is the only pack in the catalogue with a section for the other side of the table. 6 documents cover a user entity’s own reliance: the report review checklist structured on what the user auditor must consider, the CUEC mapping workbook, the SOC report inventory and coverage-gap tracker, the bridge letter request, the vendor report evaluation memo, and the carve-out follow-up tracker. If your SOX 404 programme relies on a payroll, benefits, custody or hosting provider’s report, this is the half of the pack you will use first.
The SOC 1 Toolkit was written against AT-C section 320 in the AICPA’s codification as amended through SSAE No. 22, ISAE 3402 as issued by the IAASB in December 2009, the AICPA’s management-side guidance for SOC 1 engagements, and the 2013 COSO framework, with ASAE 3402 (December 2022) checked for paragraph alignment. Every document states its sources and the date of the position. Where the two standards differ in a way that changes what management must do, the difference is stated: the representation lists, the implementation test, the missing CSOC concept, the “authorised” step in the transaction flow.
AT-C 320, ISAE 3402 and the AICPA guidance are cited by paragraph with the intent paraphrased. No text from any of them is reproduced; you need your own copy of each.
The SOC 2 Toolkit is the information security policy set for an examination under the Trust Services Criteria; the SOC 1 Toolkit does not repeat it. The SOX Toolkit is the user entity’s own ICFR programme, and the SOC 1 Toolkit’s user-entity section is where the two meet. The COSO Toolkit carries the framework the description’s control-environment section maps to. The TPRM Toolkit covers the wider third-party programme in which a vendor’s SOC 1 report is one piece of evidence.
| Section | Documents | What it holds |
|---|---|---|
| 00 Programme and Governance | 9 | Implementation guide, charter, roles, type and period memo, preconditions, auditor selection, scope change, plan, readiness workbook |
| 01 Scope and Boundary | 7 | System scoping, subservice organisation inventory and method, CSOC register, inclusive-method agreement, user-entity register, distribution policy, glossary |
| 02 System Description | 13 | Master template, eight section templates, transaction flow workbook, changes during the period, self-assessment, implementation evidence log, drafting standard |
| 03 Control Objectives | 11 | Objectives register and library, risk mapping, control activities matrix, design evaluation, key controls, CUEC register and guide, reasonableness review, RACI, specified objectives |
| 04 Control Policies and Procedures | 16 | Logical access, provisioning, access review, privileged access, change, development, operations, backup, incidents, physical, transmission, SoD matrix, onboarding, reconciliation, IPE, competence |
| 05 Operating Effectiveness | 10 | Testing plan, sampling, workpaper, evidence and requests, population completeness, deviation register, remediation tracker, monitoring, quarterly attestation, fraud escalation |
| 06 Assertion and Reporting | 12 | Type 1, type 2 and inclusive assertions, representation checklist, subsequent events, other information, draft report review, bridge letter, deficiency log, issuance, transition plan, annual calendar |
| 07 User Entity Reliance | 6 | Report review checklist, CUEC mapping, report inventory, bridge letter request, evaluation memo, carve-out tracker |
| 08 Crosswalks | 3 | AT-C 320 to ISAE 3402 / ASAE 3402 / CSAE 3416, ITGC to SOX / ISO 27001 / SOC 2, COSO principles |
00 Programme and Governance
01 Scope and Boundary
02 System Description
03 Control Objectives
04 Control Policies and Procedures
05 Operating Effectiveness
06 Assertion and Reporting
07 User Entity Reliance
08 Crosswalks
Reviews
There are no reviews yet