SOC 1 and SOC 2 for payroll HR software

Why payroll and HR software vendors are asked for SOC 1 and SOC 2

A payroll or HR software vendor is usually asked for a SOC 1 when a customer's financial statement auditor needs evidence about how the vendor's system affects the customer's internal control over financial reporting. A SOC 2, by contrast, covers controls relevant to security, availability, processing integrity, confidentiality or privacy. Payroll vendors often receive requests for both, because the financial statement auditor and the customer's security or privacy team each want different assurance from the same platform. The organization owns its controls. An implementation partner can prepare systems, configuration evidence and documentation, but only an independent CPA firm issues a SOC 1 or SOC 2 report.

The request usually arrives from procurement or the customer's finance team, often with the question of which report covers which process. Before answering, the vendor should list the customer-facing functions that touch financial data, such as payroll calculation, tax withholding, direct deposit file generation and general ledger interfaces, and decide which of them belong in the system description. The same review should identify the employee data flows, including bank account numbers, tax identifiers and compensation records, that a privacy assessment would examine. Confirm with the customer's auditor which report they will accept and what period it must cover, because that determines whether a Type 1 or Type 2 report will be enough.

Scoping is where most of the work sits. A SOC 1 and a SOC 2 may share infrastructure controls, such as access reviews and change management, but they answer different questions and may be tested over different periods. Vendors should ask each customer whether its auditor expects a SOC 1, whether the customer's own compliance team needs a SOC 2 with the privacy category, and whether any SOX-related reliance requires specific control objectives. Written answers to these questions, agreed before the examination starts, prevent the costly situation of discovering a missing control in the middle of fieldwork.

How SOX reliance pulls payroll data into a customer's ICFR

When a payroll or HR platform feeds a customer's financial statements, the customer's internal control over financial reporting can depend on the vendor's controls. The cards below follow that chain from the audit standard to the evidence a vendor should be ready to produce.

Services inside the information system

PCAOB AS 2201, paragraph B18, says that when a service organization's services are part of the company's information system, they are part of the company's internal control over financial reporting. For a payroll vendor, this means the calculation, withholding and journal output your platform produces can fall inside the customer's ICFR scope. Ask the customer whether their auditor has classified your service this way before you assume a SOC 1 is needed.

Management remains responsible for handoffs

SEC staff FAQ says management may rely on a service provider's report even when that report covers a different year-end, but management remains responsible for controls over the flow of information to and from the service organization. In practice, the customer still owns the file transfers, census uploads and approval steps that move employee pay data into and out of your system. Document those handoffs in your user entity controls so the customer can test them.

Payroll output reaches the ledger

Payroll runs often post directly to the general ledger as wages, tax liabilities and benefit deductions. An error in a rate table or a deduction code can misstate accrued liabilities or expense, not just a single employee's pay. Map which outputs flow into journal entries, who reviews them, and which reconciliations the customer performs, so the audit trail from your system to the ledger is clear.

Customers ask for vendor control evidence

Customers' financial statement auditors usually request a SOC 1 report from payroll and benefits vendors, and they may ask for bridge letters when the report period does not match the customer's year-end. A SOC 2 report can answer privacy and security questions from procurement and risk teams. Expect to supply both reports, the system description and exception details, and to explain which controls the customer must test on its side.

Confirm the period and controls first

Before the audit cycle starts, ask the customer which report type, period and control objectives its auditor needs, and whether they accept a SOC 2 in place of or alongside a SOC 1. Agree on the complementary user entity controls in writing. An implementation partner can prepare the evidence and the control mapping, but only the independent service auditor issues the report, and the scope should be settled before fieldwork begins.

Where the privacy criteria fit employee personal data

The privacy category is worth adding to a payroll or HR vendor's SOC 2 when the system stores or processes employee personal information such as bank details, tax identifiers, salary history, leave records, performance notes or benefit enrollments. Privacy is optional under the 2017 Trust Services Criteria, so the decision is yours to make with your auditor and your customers' privacy teams. Once it is in scope, the nine common criteria that carry additional points of focus are CC1.3, CC1.5, CC2.2, CC2.3, CC6.1, CC7.3, CC7.4, CC8.1 and CC9.2. Read them as a checklist of places where privacy design must show up: how roles and responsibilities for personal data are assigned, how staff are told about privacy duties, how access to employee records is restricted, how privacy-relevant incidents are detected and handled, how changes to personal data handling are authorized, and how vendors that touch employee data are managed.

Points of focus are not separate requirements. The TSC presents them as characteristics that can help you design and evaluate controls, and not every point of focus has to be addressed. Your auditor will judge whether the controls you run meet the criteria, so the useful work is to decide which points of focus fit your system, document why others do not apply, and make sure the evidence for each control is kept. Ask your auditor early which points of focus they expect to see addressed in your control matrix for each of the nine criteria, and record that agreement in the engagement letter or planning notes.

P4.2 asks the organization to retain personal information consistently with its privacy objectives. For payroll and HR software, this is where retention schedules matter most. Confirm with each customer how long employee records must be kept under their own policies and local law, then configure your platform so that retention periods, legal holds and deletion after a former employee's offboarding are enforced by the system, not only written in a policy. Keep the records that show deletion ran and what was removed, because an assessor will sample those records to test the criterion across the period of a Type 2 examination.

Choosing between SOC 1 Type 1, SOC 1 Type 2, SOC 2 Type 1 and SOC 2 Type 2

A SOC 1 Type 1 report describes a service organization's system and expresses an opinion on whether the controls relevant to user entities' internal control over financial reporting were suitably designed as of a specific date. It is a point-in-time report. It is read by the user entity's management and by the financial statement auditors (user auditors) who need to understand controls over the data your platform processes, such as payroll calculations or benefit deductions. Use is restricted to your management, user entities and their user auditors.

Point-in-time scope: the opinion covers design as of one date, with no testing of how controls operated over time.
Typical request: a customer whose auditors are planning to rely on your controls for the first year of a new engagement and need early comfort.
Restricted readership: the report is shared under a confidentiality agreement with user entities and their user auditors only.
Limited reliance: auditors generally do not rely on a Type 1 alone to test operating effectiveness across a full fiscal year.
Recurring cost: a Type 1 is usually a bridge to a Type 2, so ask whether the customer will accept it as a permanent deliverable.

Before work starts, confirm with the customer and their auditor in writing whether a Type 1 is acceptable and what date the report must cover.

How a payroll or HR SOC engagement moves from scoping to report

The sequence turns a customer's reliance requirements into a defined examination, a documented system and a report that the customer's auditors can read. Each phase closes with a named output that the next phase depends on.

Scope the customer requirements
Start by collecting the written requirements from the customers who will rely on the report, usually their financial statement auditors and their security or vendor risk teams. Confirm which report is needed (SOC 1, SOC 2 or both), which user entities and time period matter, and whether the customer's auditor expects a Type 1 or Type 2 report. The output is a scoping memo signed off by management, listing the services in scope, the report types and the audience. Ask the CPA firm for its timeline and fee structure once that memo exists, since scope drives both.
Select criteria and categories
For SOC 2, management chooses the trust services categories that match the promises made to customers. Security is always included. Privacy is usually the category that matters most for employee personal data in payroll and HR platforms, and it adds points of focus to several common criteria. For SOC 1, the focus shifts to controls relevant to customers' internal control over financial reporting, such as payroll calculation, tax withholding and benefit deductions. The output is a documented list of categories and the reasons each was included or excluded, reviewed with the CPA firm before work starts.
Prepare the system description
Management writes the description of the system, covering the services, infrastructure, software, people, procedures and data that support the in-scope services, prepared against the AICPA's description criteria. For payroll and HR platforms this includes how pay runs are built and approved, how employee data flows to and from customer systems, and which subservice organizations such as hosting providers are involved. The output is a draft description that the CPA firm reviews for completeness, and that management later uses in its written representations.
Build the control matrix
Map each in-scope criterion to the controls that address it, the owner of each control, how often it runs and the evidence it produces. For a payroll or HR platform, expect controls over payroll file changes, tax table updates, approval of bank file transmissions, role-based access to employee records and retention of personal data. Note which controls the customer must perform itself, since these become complementary user entity controls in the report. The output is a control matrix that management signs off on and that the examination team tests against.
Complete readiness work
Before the examination, run the controls the way they will be tested. Close gaps in access reviews, change approvals, joiner and leaver records and backup restoration tests, and collect the records that show each control operated. Many teams run an internal readiness review or a gap assessment at this stage, often with an implementation partner preparing systems and evidence. The partner does not issue any opinion. The output is a folder of evidence per control and a list of known gaps that management has either fixed or disclosed to the CPA firm.
Sign management's written representations
Under the attestation standards, the service auditor obtains written representations from management before the report is issued. Management confirms in writing that the system description is fairly presented, that the controls were designed and operated as described and that it has disclosed known instances of noncompliance, incidents and significant changes. The representation letter is a formal management responsibility and cannot be delegated to a consultant. The output is a signed representation letter that the CPA firm holds with the engagement file.
Undergo the CPA firm's examination
The CPA firm tests the design of controls, and for a Type 2 report, their operating effectiveness across the observation period. Expect requests for policies, population listings, sampled changes and access reviews, payroll run approvals and privacy records such as retention and disposal logs. Respond to requests promptly, keep one owner for each control and log every exception with its root cause. The output is the auditor's working papers, a list of any exceptions and the auditor's draft opinion, which management reviews for factual accuracy.
Issue and distribute the report
The CPA firm issues the signed report, which includes the system description, the auditor's opinion, the criteria tested and the test results. Management decides how the report is shared, and SOC 2 use is generally restricted to specified parties, while a SOC 3 is a general use summary. Customers' auditors then decide whether the report supports their reliance on your controls and may ask for a bridge letter if the report period ends before their audit period. The output is the issued report, a distribution record and a calendar for the next examination.

What a SOC 1 or SOC 2 costs for an HR or payroll vendor

This table compares the main cost components of a SOC 1 or SOC 2 examination for a payroll or HR vendor, showing who is paid, whether the cost is one-time or recurring, and what moves it. Use it to build a quote request, since the CPA firm, the implementation partner and your own staff each carry different parts of the work. The main takeaway is that the examination fee is only one line, and a SOC 1 scope extension can add cost that a SOC 2 alone would not.

Cost component	Who is paid, and for what	One-time or recurring	What drives it up or down
CPA firm examination fee	The CPA firm, for the examination and the report issued by the firm	Recurring each report period, with a larger first cycle	Number of criteria in scope, number of locations and systems, Type 1 versus Type 2, and whether customers' payroll cycles need a SOC 1 too
Readiness support	An implementation partner, for preparing systems, controls and evidence before the auditor arrives	Mostly one-time, plus periodic support later	Maturity of existing controls, how many payroll and HR systems are in scope, and whether the partner also runs ongoing evidence collection
Tooling and GRC platform	The software vendor, for licenses; sometimes the partner or your own team, for setup	Recurring subscription, plus one-time configuration	Number of integrations to HRIS, identity, cloud and ticketing systems, and whether you self-host open-source tools that avoid license fees but need operating effort
Internal staff time	Your own engineering, HR, payroll operations, legal and finance staff, paid through payroll budgets	Recurring, with a heavier first year	Number of people who approve access, perform reviews and answer auditor requests, and how well joiner and leaver processes are already documented
SOC 1 scope extension	The CPA firm, for added examination work over controls relevant to customers' internal control over financial reporting	Recurring if the SOC 1 is kept, plus one-time scoping	Whether customers' financial statement auditors need the report, the number of financial processes covered such as pay calculation and tax filing, and the number of user entities requesting it
Privacy criteria work	Implementation partner and your legal or privacy team, plus the CPA firm for the added examination	Mostly one-time design, with recurring retention and disposal reviews	Volume of employee personal data held, retention rules for payroll records, and how many privacy criteria your customers ask you to include
Penetration testing and third-party reports	Independent testers, and sometimes subservice providers for their own SOC reports	Recurring, usually annually or per release	Scope of applications and APIs tested, and how many subservice organizations you rely on for hosting or payments

What makes a payroll or HR SOC report larger or slower

The size and pace of a payroll or HR examination follow from a few scope decisions made early, before fieldwork starts. Each driver below affects how many controls an auditor tests, how many third parties must be explained, and how much evidence the team must produce, so each one is worth deciding deliberately rather than inheriting by default.

Customer-facing modules in scope

Every module that processes payroll runs, benefits enrollment, time entry or employee records adds access paths, change streams and reconciliations that the auditor may need to test. Narrow the system description to the modules that feed customers' financial reporting or hold their employee data, and document why any other module sits outside the boundary. Ask the auditor early which modules they expect to sample, since that choice drives testing volume more than the total feature count does.

Benefits and tax filing data

Benefits enrollment, deduction and tax filing data carry financial impact, so they often move the engagement from a privacy-only view into a SOC 1 question. Decide whether tax filing runs inside your system or through a separate filing provider, and whether benefits carriers receive data directly. Each data flow that touches a customer's payroll liability needs a control owner, a reconciliation and evidence that errors are caught.

Single region or several

Hosting in one region keeps infrastructure controls, backup tests and access reviews to one environment. Operating in several regions multiplies those controls, and it can also change which data residency and transfer obligations customers raise. Confirm with your auditor whether each region needs its own sample of evidence, and whether a shared control framework can cover all regions with region-specific logs.

Subservice organizations and carve-outs

Payment processors, cloud providers, background check firms and banking partners each appear in the system description. Decide whether each is carved out, where you rely on its own SOC report, and which complementary subservice organization controls you expect customers to consider. Each carve-out needs a documented vendor review and a current report on file, so a long vendor list adds review work even when each vendor is small.

Privacy criteria for employee data

Adding the privacy category brings in P1 to P8, which cover notice, consent, retention, disposal and disclosure of personal information. Payroll and HR systems hold national identifiers, bank details and health-related leave records, so privacy adds notice and retention controls that are different in kind from security controls. Confirm with customers whether they ask for privacy in the report, and map which of the nine common criteria with extra points of focus your design must address.

Maturity of evidence

An auditor tests what the system can prove, so weak or manual evidence lengthens fieldwork and raises the chance of exceptions. Access reviews kept in spreadsheets, change tickets without test results and reconciliations without owners all take longer to sample. Before the observation period begins, confirm that logs are retained, reviews are dated and signed, and recurring reports can be pulled on request. Ask the auditor which evidence formats they accept for each control.

Who owns controls, who prepares evidence and who reports

The software vendor owns its control environment. Management decides which controls exist, who is accountable for them, how they operate day to day, and what the system description says about them. The vendor also signs the management assertion and the representation letter that the examining CPA relies on, so management cannot hand those responsibilities to anyone else. For payroll and HR software, the vendor's own staff typically run the processes that matter most to customers: granting access to employee and payroll data, approving changes to tax tables and pay calculations, and responding to incidents that touch personal information.

Control ownership: named owners for each control in the control matrix, with authority to change the control and accountability when it fails.
Management assertion: written statements by management about the system description and control design or operation, signed before fieldwork begins.
Operational records: access approvals, change tickets, reviews and incident records produced by the vendor's own tools and people.
Subservice organizations: decisions about which cloud, payroll tax or banking providers are carved out and which complementary controls customers must perform.

Ask the vendor to show, for each control, who owns it, where its evidence lives and who would answer for a failure.

What must be in place before the examination starts

A SOC 2 or SOC 1 examination tests what exists on a stated date or over a stated period, so the auditor needs a defined system, a control set tied to criteria, and records that prove the controls ran. The cards below cover the items an assessor asks for first, and each one names what to check before fieldwork begins.

Written system description

The system description states which payroll, HR or benefits services are covered, the infrastructure and software that deliver them, the data flows, the people who operate them and the boundaries of the report. Management prepares it under the description criteria, and the auditor compares it against what actually runs. Check that every product module, hosting location and data feed that customers rely on appears in it, and that nothing listed is out of date with the production environment.

Control matrix mapped to criteria

The control matrix lists each control, its owner, how often it runs, the evidence it produces and the criterion it addresses, such as CC6.1 for logical access. For a payroll or HR vendor, pay-run approval and tax-table updates may need controls alongside the security criteria. Confirm that every selected criterion has at least one control, that no control is orphaned, and that each control can be sampled over the period.

Access and change records for the period

For a Type 2 examination the auditor samples access grants, removals, privileged reviews and production changes across the observation window. Payroll and HR systems hold employee bank details and salary data, so access to those records is tested closely. Confirm that tickets, approvals and reviews are retained in a form an auditor can pull for any sampled date, and that the population of changes can be reconciled to the deployment history.

Subservice organizations and complementary user entity controls

Payroll and HR platforms often depend on cloud hosts, payment processors, tax calculation services and e-signature providers. Each one must be named, with the carve-out or inclusive method stated, and each provider's own SOC report reviewed for the period. Complementary user entity controls describe what customers must do themselves, such as approving pay runs or removing leavers from their tenant. Check that these are written down and shared with customers in plain terms.

Privacy notice and retention schedule

If the privacy category is in scope, the privacy notice must describe what employee personal data is collected, why, and how long it is kept. Criterion P4.2 requires that personal information be retained consistently with the privacy objectives, so a retention schedule with deletion evidence is needed. Confirm the notice matches actual practice, that deletion jobs run and log results, and that employee requests for access or correction have a documented route.

SOC 1 control evidence process

When a customer's financial statement auditor needs a SOC 1, the controls that affect financial reporting, such as payroll calculation, file transmission and reconciliations, must be identified separately. Evidence for those controls, including exception reports and reconciliation sign-offs, must be retained for the whole period. Confirm with customers' auditors which control objectives they need, and set up the evidence routine before the period begins rather than reconstructing it afterward.

Questions payroll and HR vendors ask before a SOC 1 or SOC 2

Do payroll or HR software vendors need a SOC 1, or is a SOC 2 enough?

It depends on what your customers' auditors need. A SOC 1 examines controls likely to be relevant to user entities' internal control over financial reporting, and it is meant for the CPAs who audit those customers' financial statements. A SOC 2 addresses controls relevant to security, availability, processing integrity, confidentiality or privacy, and it is aimed at a broader group of technical and risk readers. If your payroll or benefits calculations flow into a customer's financial statements, expect the customer's auditor to ask for a SOC 1. If customers mainly ask about data security and employee personal data, a SOC 2 may be the primary request. Ask each large customer which report its auditor or procurement team requires before you commit to a scope.

Can one report cover both SOC 1 and SOC 2 needs?

No. The two examinations serve different purposes and are reported differently, so a vendor usually needs a separate SOC 1 and SOC 2 with their own control scope. Many controls overlap, such as access management, change management and backup, so the same evidence can often support both examinations. The work that differs is the control objectives, the system description and the audience. Confirm with your CPA firm how they plan to reuse testing and whether the two engagements will run over the same period.

How does a customer's financial statement auditor use a SOC 1 report?

The customer's auditor reads the SOC 1 to understand the controls at your organization that affect the customer's financial reporting, then decides how much work to do themselves. Under the SEC's guidance, management may rely on a service provider's report as of a different year-end, but it stays responsible for controls over the information it sends to and receives from the provider. That is why customers ask for bridge letters and clear complementary user entity controls. Use of a SOC 1 report is restricted to your management, user entities and their user auditors, so share it under an agreement.

What does the work need from our internal staff?

Internal staff own the controls, so the work is mostly theirs even when an outside firm helps. Expect time from HR and payroll operations to define processes, from engineering to show how production access, deployments and changes are controlled, and from security or IT to produce access reviews and logs. Someone must answer the CPA firm's evidence requests quickly and keep a control matrix current. For a Type 2 examination, these people also need to perform the controls consistently across the observation period, not only before the audit starts.

Can we prepare for a SOC 1 or SOC 2 without outside help?

Some organizations do, particularly when they already run documented change, access and incident processes. The CPA firm performs the examination and issues the report, and the organization must prepare the system description, controls, policies and evidence itself. Outside help can cover gap assessment, control design, evidence collection tooling and remediation. Decide which parts to keep in-house and which to buy by listing the controls you already operate and the evidence you cannot yet produce. An independent auditor must perform the examination regardless of who prepares your systems.

How does the privacy category change the work for an HR platform?

Privacy is optional in a SOC 2, but HR and payroll platforms usually hold employee personal data, so customers often ask for it. When privacy is in scope, nine common criteria carry additional points of focus: CC1.3, CC1.5, CC2.2, CC2.3, CC6.1, CC7.3, CC7.4, CC8.1 and CC9.2. The 18 privacy criteria (P1 to P8) add expectations for notice, consent, collection, retention, access, disclosure and monitoring. Criterion P4.2 requires you to retain personal information consistently with your privacy objectives, which means defined retention periods and tested disposal. Adding privacy usually increases the number of controls and evidence samples, so confirm the scope with your CPA firm early.

What cost and timing drivers should we ask the CPA firm about?

Ask the firm to quote from a written scope that lists the report type (SOC 1 or SOC 2, Type 1 or Type 2), the categories in scope, the number of systems and subservice organizations, the observation period and the number of locations or products. Cost usually rises with added categories, a longer observation period, more subservice organizations to address and more customer-specific requests such as bridge letters. Ask what is one-time, such as the readiness work and first examination, and what recurs, such as annual fieldwork and monitoring. Ask which evidence the firm will sample and how it will handle exceptions, because remediation before testing can change both time and fees.

How DeployOpen prepares payroll and HR systems for the examination

DeployOpen plans, implements, hardens and documents the self-hosted open-source platforms inside a client's own infrastructure that handle payroll and HR data. We prepare systems, controls and evidence for the examination, while the independent CPA firm performs the SOC 1 or SOC 2 examination and issues the report.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope states which platforms, environments and data flows fall inside the system description for the examination.
Scoping confirms whether the engagement targets SOC 1, SOC 2, or both, and which Trust Services categories the client chose.

How we build

We configure payroll and HR platforms with access controls, logging and change management aligned to the agreed scope.
We document control design, owners and recurring evidence so the auditor can trace each control to an operating record.
We test the configured controls internally before the auditor's fieldwork so gaps appear while there is still time to close them.

How we hand over

Handover includes system documentation, the control matrix, runbooks and the evidence collection procedure for the client's team.
The client receives records that show how controls operated, arranged for the CPA firm's sampling and evidence requests.
Ownership of each control, including the controls the client's management must own, is stated in writing at handover.

How we support

Ongoing support, upgrades and continuous testing are available as retainers for the period between examinations.
Support can cover monitoring evidence, platform upgrades and the controls that change when a new payroll or HR module is added.
Questions from the CPA firm about our configuration and evidence can be answered by our team, while the auditor forms the opinion.