Rule Atlas
SOC 1: Third-Party Risk Management (TPRM)
Under SOC 1 (AICPA / FASB / IRS), third-Party Risk Management (TPRM) establishes the authoritative rules tested on the CPA Exam. A comprehensive guide to the TPRM lifecycle, vendor due diligence, and interpreting SOC reports for the ISC exam. VoraPrep verifies every threshold, worked table, and practice question below against the current CPA Exam blueprint.
SOC Reports: The Auditor's Toolkit
| Feature | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| Purpose | Reports on controls at a service organization relevant to a user entity's Internal Control over Financial Reporting (ICFR). | Reports on controls relevant to the Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). | A general-use, high-level summary of the SOC 2 report. |
| Audience | User entity management and their financial statement auditors. | User entity management, regulators, and business partners with sufficient knowledge. | The public; often used for marketing purposes. |
| Content | Detailed description of controls, tests performed by the auditor, and results. | Detailed description of controls, tests performed, and results against the Trust Services Criteria. | A brief overview with the auditor's opinion but no detailed test results. |
| Distribution | Restricted Use | Restricted Use | General Use (publicly available) |
Apex Financial, a financial services firm, outsources its cloud data processing to a third-party vendor. To comply with industry regulations and protect sensitive customer data, what is the most critical component of the firm's third-party risk management (TPRM) program?
Worked Example: Selecting a Cloud Payroll Provider
Scenario. Alpha Corp, a nonissuer, needs to select a new cloud-based payroll provider. As the IT auditor, you are tasked with guiding the due diligence process.
- Step 1: Planning Alpha's management defines the need: a reliable payroll service that can handle sensitive employee PII (Personally Identifiable Information) and integrate with their HR system. The risk appetite is low; data security is paramount.
- Step 2: Due Diligence Two vendors, PayRight and SecurePay, are shortlisted. You request their SOC reports. PayRight provides a SOC 1, Type 2 report with an unmodified opinion. It covers controls relevant to financial reporting. SecurePay provides a SOC 2, Type 2 report, also with an unmodified opinion. It covers the Security and Confidentiality Trust Services Criteria.
- Step 3: Analysis & Selection Since Alpha Corp is primarily concerned with the security and confidentiality of PII, not just its impact on financial statements, SecurePay's SOC 2 report is more relevant to their key risks. You review the report and note the section on Complementary User Entity Controls (CUECs), which requires Alpha to implement strong password policies for its employees accessing the system.
- Step 4: Contracting & Onboarding Alpha Corp selects SecurePay. The contract explicitly references the SOC 2 report and requires annual updates. During onboarding, Alpha's IT department implements and documents the required CUECs, ensuring their end of the shared responsibility model is met.
Common CPA Exam Distractors on SOC 1
- 1Bottom line: On the exam, always match the specific risk presented by the vendor to the appropriate TPRM lifecycle stage and the corresponding level of control evidence required.
- 2When performing vendor due diligence, use the FRISCO mnemonic to remember the key areas to investigate:
- 3Financial Stability: Will the vendor be a going concern?
- 4Regulatory Compliance: Do they comply with relevant laws (e.g., GDPR, HIPAA)?
- 5Information Security: What is their security posture? Do they have a SOC 2 report?
Frequently Asked Questions: SOC 1
What is the core rule under SOC 1 (Third-Party Risk Management (TPRM))?
Under SOC 1 (AICPA / FASB / IRS), third-Party Risk Management (TPRM) establishes the authoritative rules tested on the CPA Exam. A comprehensive guide to the TPRM lifecycle, vendor due diligence, and interpreting SOC reports for the ISC exam. VoraPrep verifies every threshold, worked table, and practice question below against the current CPA Exam blueprint.
How is SOC 1 tested on the CPA Exam?
Bottom line: On the exam, always match the specific risk presented by the vendor to the appropriate TPRM lifecycle stage and the corresponding level of control evidence required. When performing vendor due diligence, use the FRISCO mnemonic to remember the key areas to investigate:
Where can I practice CPA Exam questions on Third-Party Risk Management (TPRM)?
Test yourself instantly with the free playable CPA Exam question on this page, or launch VoraPrep's full CPA Exam adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cpa.