Your organization is undergoing an audit to assess its compliance with industry standards and regulations. The auditor requests a specific type of audit report that provides assurance on controls relevant to financial reporting. Which type of audit report should your organization provide to meet this request?

A SOC 1 (Service Organization Control 1) report is specifically designed to address controls at a service organization that are relevant to a user entity's internal control over financial reporting (ICFR). When an auditor requests assurance on controls impacting financial statements, the SOC 1 report is the appropriate document. It provides the user entity's financial statement auditors with the information they need to assess the risks arising from the services provided by the service organization. This directly matches the auditor's request in the scenario.

A. SSAE 18 is the attestation standard under which SOC reports are issued, not the report itself.
B. A SOC 2 report focuses on controls related to the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
D. A SOC 3 report is a general-use, high-level summary of the SOC 2 report and does not contain the detailed information required for a financial audit.

1. American Institute of CPAs (AICPA). (2022). SOC 1®—SOC for Service Organizations: ICFR. "A SOC 1® report is designed to help service organizations that provide services to other entities, build trust and confidence in their service delivery processes and controls... through a report by an independent CPA... The report is on the controls at a service organization that are relevant to a user entity’s internal control over financial reporting (ICFR)." Retrieved from aicpa.org.

2. Cloud Security Alliance (CSA). (2017). Security Guidance for Critical Areas of Focus in Cloud Computing v4.0. Page 101, Section on "SOC 1/SSAE 18/ISAE 3402". "This report audits controls relevant to a client's financial reporting."