What to do when a SOX-relevant vendor has no SOC 1 report
When a service provider touches your financial reporting and cannot supply a usable SOC 1 Type 2 report, management still owns the assessment of the controls over that outsourced work. The provider's absence of a report does not transfer that responsibility, so you need evidence about operating effectiveness obtained another way. PCAOB AS 2201 paragraph B20 gives three routes: your own controls over the provider's output, such as reconciling its results to source documents; tests performed at the provider; or a service auditor's report that includes tests of operating effectiveness. Your choice among them depends on how significant the provider's activities are to the financial statements, how much time has passed since any report period, and whether errors have appeared in its processing or its controls have changed.
In practice, start by mapping which assertions the provider's output affects, such as a payroll file feeding the general ledger or a pricing table driving revenue. For each, decide whether your own review of the output can detect a material error in time. A reconciliation to invoices, bank records or sub-ledger totals, performed by someone independent of the process and retained as evidence, often carries the most weight. Where the output is too voluminous or opaque to review, ask whether the provider will allow tests of its controls directly, which AS 2201 paragraph B26 lists among the options. Ask the provider in writing what it will provide, how long it takes, and whether a service auditor will perform specific procedures for you. Confirm these details with the provider and your auditor before the period begins, since the SEC staff FAQ (Question 8) confirms that the responsibility to assess outsourced controls stays with management.
Keep the roles clear. Your organization owns its controls and the conclusion on them. A partner such as DeployOpen can help prepare systems, reconciliation designs and evidence packages for your team to review, but it does not issue opinions. Only an independent auditor can form an opinion, and your external auditor will decide whether the evidence you present is sufficient. Raise the gap with that auditor early. A vendor without a SOC 1 report is a finding about evidence, and how it affects the assessment depends on the facts, so agree the planned procedures with the auditor before relying on them.
How to build the evidence when the report is missing
This sequence turns a vendor with no usable SOC 1 Type 2 into a documented set of procedures, each tied to a financially significant process, so management can conclude whether the gap is a control deficiency. Each phase produces a record that the next phase depends on.
Map the provider's role in each process
Start from the financial close and reporting process, not from the vendor list. For each process, document which provider performs which activity, such as transaction processing, calculations, data hosting, or report generation, and where its output enters your ledger or disclosure process. Owners are the process owner and the SOX program lead, working from walkthroughs. The output is a process map that names each handoff to the provider, the data it sends and receives, and the control that consumes its output. The step is done when every handoff in scope has a named internal reviewer.
Assess significance and risk of each provider
Decide how much the provider's activity matters to the financial statements. Consider the size and nature of the transactions it processes, the accounts and assertions affected, the volume of manual intervention, the provider's error history, and how recently its processing changed. Management makes this judgment and records its rationale, and the external auditor will read it. The output is a risk rating for each provider with a stated reason, along with the list of reliance decisions that depend on it. The step closes when each rating is approved by the control owner and the SOX lead.
Search for any partial assurance
Before building new procedures, collect everything the provider can produce: a SOC 1 Type 1 report, a bridge letter covering the gap, a SOC 2 report with relevant criteria, ISO certificates, penetration test summaries, and its own control descriptions. Ask whether the provider's auditor was engaged to test operating effectiveness, and for which period. Note what each document covers and what it does not. The output is an inventory of available assurance with coverage gaps marked. This step closes when the inventory is reviewed against the process map and each gap is linked to a specific control objective.
Choose the evidence route for each gap
Select one route per gap, based on the provider's significance and the nature of the risk. Options described in PCAOB AS 2201 include testing your own controls over the provider's output, such as reconciling its results to source documents, obtaining a service auditor engaged for specific procedures, or testing at the provider. Management may also evaluate the provider's own procedures or request information through the company. The output is a documented route for each gap, with the reason it fits and the party who will perform the work. The step is complete when the route plan is approved before testing starts.
Perform and document the procedures
Execute the chosen procedures with defined populations, sample selections, and expected results written down in advance. For output reconciliation, record the source documents, the reconciling items, and who reviewed each difference. For provider-side or agreed-upon procedures, confirm contract rights to access and the scope the provider will accept. Keep the evidence in a form the external auditor can re-perform, including request dates and the people involved. The output is a workpaper set per gap. The step closes when a second reviewer has checked the workpapers against the planned procedures.
Evaluate exceptions and the effect on reliance
Compare results with the expected outcomes and determine whether errors or failed procedures affect the reliance placed on the provider. Consider the frequency and nature of any errors, whether they reveal a control weakness at the provider or in your own review, and whether the procedures covered the full period. Where the evidence is incomplete, decide whether additional procedures close the gap or whether a compensating control is needed. The output is a written evaluation for each exception. This step is done when each exception has a disposition and an owner.
Conclude on the deficiency and communicate it
Conclude whether the absence of assurance, combined with any exceptions, represents a control deficiency, and assess its severity against the likelihood and magnitude of a misstatement in the affected accounts. Management owns this conclusion and documents it, and the external auditor evaluates it independently. Where the gap cannot be closed before year end, record remediation steps and communicate with the audit committee and auditor as your process requires. The output is a signed deficiency assessment that ties back to the process map and evidence inventory. The step is complete when the conclusion is reviewed and filed with the ICFR documentation.
Which evidence route fits your situation
This route tests the controls your organization runs over the provider's output rather than the provider's controls themselves. A common example is reconciling the totals a provider posts to the general ledger back to the source documents or to an independent system extract, then checking that exceptions are investigated. It fits when the provider's processing is material but its output is limited in volume and can be compared with data you already hold. Evidence is the reconciliation, the population it covers, the investigation trail and the reviewer's sign-off. The limit is that it verifies the output for the period you tested, not whether the provider's general controls operated throughout the year. Confirm with your auditor that the precision of the reconciliation is enough to address the risk of misstatement the provider's processing creates.
Here you engage an independent accountant to perform specific procedures you define and report the results without issuing an opinion. It fits when you need a focused test, such as checking user access listings or change tickets for a defined population, and a full service auditor engagement is not practical. The evidence is a written report of the procedures, the exceptions found and the population tested. The limit is that the report describes what was done and found, it does not conclude on the operating effectiveness of the provider's controls. Ask the practitioner to confirm in writing which procedures they will perform, how populations are defined, and whether the results will be usable as evidence in your own assessment. Your external auditor decides whether that evidence is sufficient.
Under this route a service auditor performs tests of controls at the service organization itself, and you use the results in your assessment. It fits when the provider is significant, when a SOC 1 Type 2 report is absent or lacks tests of operating effectiveness, or when a report's period no longer covers your fiscal year end. The evidence is the service auditor's test results and the access, procedures and sampling the auditor documents. The limit is practical: the provider must agree to the engagement, the service auditor needs access to its systems and records, and the scope and timing must be negotiated in advance. Confirm the service auditor's independence, the control objectives covered and whether the report can be shared with your auditor under the provider's contract.
This route covers two lower-cost steps: evaluating the procedures management uses to oversee the provider, and asking the provider, through your organization, for information about its controls. Oversight can include reviewing the provider's service level reports, its security questionnaires, its incident notifications, its subservice organization list and its written responses to your questions. It fits as a first step or when the gap is information rather than a missing test. The evidence is a documented review, the questions asked, the provider's written answers and your conclusion about their reliability. The limit is that answers from a provider are not independent testing, so this route rarely closes the gap alone. Ask the provider for named owners, dated responses and copies of any bridge letter or internal audit report it is willing to release.
What raises the amount of evidence you need
Under PCAOB AS 2201, the evidence you need from a service organization is not fixed. It rises or falls with several conditions, and each one can be reduced by how you design your own controls. The cards below cover the drivers auditors weigh and the practical steps that lower them.
Time elapsed since the report period
A provider's SOC 1 report covers a past period, so the longer the gap before your assessment date, the less it tells you about current operation. Check how far the report period ends from your fiscal year end and whether the provider has made changes since. Where the gap is wide, ask the provider for a bridge letter and add your own interim tests over the uncovered months. Ask your auditor early which gap they will accept.
Significance of the provider's activities
The more a provider's processing affects reported balances, the more evidence auditors expect. A payroll provider that calculates accrued compensation is far more significant than a provider that only hosts a training log. Map each provider to the accounts, transaction classes and disclosures it touches, then rank them. Your evidence effort should follow that ranking, not the size of the contract.
Errors found in its processing
Any error the provider's output produces, or any exception you find while testing it, signals that the provider's controls may not be working as described. Auditors treat recent errors as a reason to test more deeply, and they may ask whether the errors were isolated or systemic. Log every exception, ask the provider for root cause and corrective action, and retest the affected population before the assessment date.
Changes in its controls
Changes to a provider's control environment, such as new personnel in key roles, a new system release, a reorganization or a change in the subservice organizations it uses, reduce confidence in older results. Request written notice of material changes as a contract term and record each one in your vendor file. When a change touches a control you rely on, repeat your tests over the affected period rather than assuming the prior results still hold.
Scope of the affected accounts
The narrower the set of accounts and assertions a provider's output supports, the easier it is to test those outputs directly. A provider feeding one reconciling account needs a focused test. A provider feeding many ledgers, sub-ledgers and disclosures needs broader coverage. Define the account list, the report types and the assertions in writing before testing begins, and confirm the list with your auditor so the evidence matches what they will examine.
Sole custody of key data
If the provider holds the only copy of key data, such as transaction detail, rate tables or payroll master files, you cannot compare its output to an independent source. Auditors then need evidence from the provider itself, which is slower and harder to obtain. Reduce this by requesting regular extracts into your own environment, reconciling them to the general ledger and keeping retained copies that you control.
How evidence gaps change the ICFR conclusion
Management decides whether an evidence gap is a control deficiency, and how severe it is, before anyone else gets to judge it. When a SOX-relevant provider has no usable SOC 1 Type 2 report, the question for management is whether the control over the financial reporting risk still operates, and whether the company can show it. If the company cannot show that the provider's output was processed correctly, the gap is a deficiency in the company's own ICFR, even if nothing has gone wrong. Severity depends on the account or disclosure the provider's output feeds, the magnitude of the potential misstatement and the likelihood that the gap would let one through. Management should document that reasoning in writing for each provider, because the same missing report can be minor for a low-risk reconciliation and serious for a revenue or close process.
Compensating controls at the company can close the gap, but only if they are precise and tested. A compensating control is one the company runs itself that addresses the same risk, such as reconciling the provider's output to source records at a precision that would catch a material error, or reviewing exception reports the provider delivers. The company should confirm who performs the control, what threshold triggers investigation, what evidence it retains and whether the control was operating throughout the period, not only at year end. A general statement that the company reviews vendor reports does not usually satisfy an assessor. Ask the external auditor early what precision they would accept, since that answer determines whether the compensating control is worth building.
The external auditor decides whether the evidence is sufficient, and the company should raise the gap early. Management owns the conclusion, but the auditor, where Section 404(b) applies, decides whether the evidence supports it. Auditors weigh the significance of the provider's activities, the time elapsed since any report period, errors found in processing and changes in the provider's controls, as PCAOB AS 2201 describes. A gap found during the final weeks before the filing leaves little room to build, test and roll forward a compensating control. Bring the gap to the auditor when it is identified, document the options considered, and agree the evidence standard before the year-end testing window opens. Early disclosure of the gap is far less costly than an unexpected deficiency at the end of the year.
What to have in place before the assessment
When a provider has no usable SOC 1 Type 2 report, the auditor falls back on evidence you hold yourself. The cards below cover the records that make those fallback procedures possible, and each one says how to check that it is ready before the assessment starts.
Inventory of outsourced processes
List every process in the financial reporting chain that a provider performs or touches, such as payroll calculation, revenue billing feeds, bank reconciliations or tax provisioning. For each process, record the provider, the output it produces and the systems that receive it. Check that every process named in your ICFR process narrative appears on the list, because an auditor who finds an unlisted provider will question the completeness of the whole scope.
Provider-produced reports and reconciliations
Identify each report the provider sends you, such as settlement files, invoice registers or balance extracts, and the reconciliation you run against source records. A reconciliation that compares provider output to source documents is the evidence an auditor most often accepts when no SOC 1 report is available. Confirm that each reconciliation is performed by someone independent of the provider, dated, signed off and retained for the full period under review.
Named provider contacts
Keep a current list of the people at the provider who can answer control questions, supply documentation and arrange any visit or testing. Record the route the company uses to reach them, since the auditor may ask management to make the contact rather than contacting the provider directly. Check that the contacts are authorized to speak for the provider and that the list includes someone who can explain changes to the service during the period.
Documented management procedures
Write down how management assesses the provider's output and controls, including who reviews it, how often and what happens when an exception appears. Management keeps this responsibility even when a service auditor's report exists, so the document must show that management did the work and not only that the provider did. Check that the procedure names owners, frequency and escalation steps, and that management can show evidence that the procedure ran during the period.
Record of past errors and changes
Maintain a log of errors the provider made, the changes it announced to its processing or controls, and how each was corrected. These events determine how much additional evidence the auditor will require, because more errors and more changes raise the need for procedures. Check that the log covers the whole period under review, that each error links to a root cause and a correction, and that changes to the provider's service are recorded with dates.
Who does what when a provider cannot supply a report
Management owns the assessment. When a provider has no usable SOC 1 Type 2 report, the company still has to decide whether the provider's output affects financial reporting, document the risk, and evaluate its own controls over that output. The SEC staff FAQ is clear that management keeps this responsibility even when it relies on a service auditor's report, and that responsibility does not disappear because the report is missing.
- Scoping the dependency: Identify which provider processes, calculations or data feeds reach the financial statements, and record why each one matters.
- Designing compensating procedures: Build controls such as reconciling provider output to source records, reviewing exception reports and approving changes that affect reported numbers.
- Keeping the evidence: Retain the reconciliations, review sign-offs and access records that show the controls operated throughout the period.
- Evaluating deficiencies: Assess any gaps in severity and decide whether they are control deficiencies, significant deficiencies or material weaknesses.
- Owning the conclusion: Management signs the ICFR assessment, so the company must be able to explain its reasoning to the auditor.
Check whether your documented scope, risk assessment and compensating controls match the provider's actual role in your processes.
The provider controls its own operations and is the only party that can make changes to its service. When it has no SOC 1 Type 2 report, it may still cooperate by supplying process documentation, system descriptions, change records and access reviews. The provider's contract shapes what it must share, so the terms set the boundary of what is possible.
- Describing its controls: Provide documentation of how the service is run, including processing steps, change management and access administration.
- Supplying records: Produce logs, change tickets, access listings and processing reports for the periods you need to test.
- Allowing testing: Where the contract permits, accept on-site visits or procedures performed by your team or a service auditor.
- Notifying changes: Tell you about changes to its systems or controls that could affect the reliability of output.
- Clarifying limits: State in writing what it cannot provide, so you can plan around the gap early.
Confirm that your contract gives you audit or information rights that cover the periods and records your assessment requires.
An implementation partner such as DeployOpen can help prepare systems, controls and evidence, and can perform testing that management directs. This work is often fixed-scope and written in advance. The partner does not own the controls, does not decide whether a deficiency exists, and does not issue reports or opinions. Its output supports management's assessment and the auditor's work.
- Preparing evidence: Organize reconciliations, access exports, change records and configuration captures in a form that auditors can test.
- Building compensating controls: Design and document reconciliation or review procedures, where the company asks for help.
- Testing controls: Perform agreed procedures on the company's own controls over provider output, and report results to management.
- Supporting self-hosted systems: Where the company runs open-source platforms in its own infrastructure, produce logs and configuration evidence from those systems.
- Staying independent: A partner that prepares evidence does not also attest to it. Only an independent auditor or service auditor issues a report or opinion.
Ask any partner to state in its written scope exactly which tasks it performs and which belong to management or the auditor.
The external auditor tests ICFR under PCAOB AS 2201 and assesses IT risks under AS 2110. Where a provider has no usable report, the auditor decides how much additional evidence it needs, drawing on the options in AS 2201 such as testing the company's own controls over the provider's output, engaging a service auditor for specific procedures, or testing at the provider. The auditor's conclusion, not the partner's work, determines the result.
- Assessing risk: Consider the significance of the provider's activities, the time since any report period, errors found in processing and changes to controls.
- Choosing procedures: Decide whether to test the company's compensating controls or to extend procedures to the provider.
- Engaging a service auditor: Where a separate examination is needed, the service auditor performs and reports on the procedures it is engaged to run.
- Forming the opinion: The external auditor alone issues the attestation under Section 404(b) where it applies.
- Communicating gaps: Report significant control weaknesses to management and the audit committee.
Agree early with your auditor which procedures it will accept, so the provider gap is not discovered at year end.
How to choose a partner for the evidence work
A partner can prepare test procedures, reconciliations and evidence files for a vendor gap, but it cannot replace the provider's report or the auditor's judgment. The cards below cover the checks that separate a useful evidence partner from one that creates new risk for your ICFR program.
Confirm relevant SOX ITGC experience
Ask for examples of work on financially significant systems, described in general terms: which control areas were covered, how reconciliations were built and how the external auditor reviewed the evidence. Ask who will do the work and whether those people have worked on SOX programs before, not only on general security assessments. Check that they understand the difference between testing a provider's controls and testing your own controls over the provider's output.
Confirm no attestation role
Get written confirmation that the partner will not issue audit reports, attestations or opinions. Only an independent service auditor or the company's external auditor can do that. The partner prepares procedures and evidence for management, and the contract should say so in plain terms. A partner that offers a report or assurance letter in its own name is outside its role and creates a risk for your assessment.
Require a fixed written scope
Ask for a written scope that lists the vendor, the financial process, the period covered, the control objectives, the systems and the sample sizes or population definitions to be used. Confirm the deliverables, what is excluded and what happens if the auditor asks for procedures beyond that scope. Fixed scope lets you compare quotes on the same work and gives your finance and audit teams a clear basis for approving the effort.
Require test scripts and evidence indexes
Ask for the test scripts or procedure documents that will be run, the reconciliation logic, and an evidence index that maps each file to the control objective and the auditor request it answers. Scripts should be reproducible by your own staff. An index lets the auditor trace a conclusion back to source records without a long walkthrough, and it reduces the risk that evidence is re-collected under time pressure near year end.
Agree who speaks to the external auditor
Decide before work starts whether the partner may speak with the external auditor, and under what conditions. In most arrangements management owns the auditor relationship, and the partner answers questions through management. Confirm who receives auditor requests, who approves responses, and how changes to procedures are documented. Clear ownership prevents conflicting explanations of the same evidence and keeps management responsible for its assessment.
Questions buyers ask about vendors without a SOC 1 report
Can we use a SOC 2 report instead of a SOC 1 for SOX?
Not by itself in most cases. A SOC 2 report covers trust services criteria such as security and availability, while a SOC 1 report is built around controls relevant to a customer's internal control over financial reporting. PCAOB AS 2201 asks for evidence that a provider's controls operated effectively, and a service auditor's report without tests of controls and an opinion on operating effectiveness does not supply that evidence. A SOC 2 can still inform your risk assessment, and it may show which provider controls exist, but you should confirm with your external auditor whether it can be used for a specific financial process and what additional procedures they will expect.
Does the vendor have to produce a SOC 1 report for us?
No provider is legally required to produce one under SOX. Section 404 places the obligation on the issuer, which must assess its own internal control over financial reporting, and its auditor attests where Section 404(b) applies. The practical question is whether the provider's service still lets you meet that obligation. If it does not provide a SOC 1 Type 2, you need other evidence, and your contract should set out what the provider must supply, such as access for testing, reconciliations, or a cooperation clause. Confirm with your auditor which evidence they will accept before you negotiate.
What does this cost in effort, and who pays for it?
You pay for most of the effort, because management keeps the responsibility for the controls over outsourced operations even when a service auditor's report exists. Costs fall into a few parts: your staff time to map the provider's output into your own controls, any reconciliation or review tooling, the provider's time to support testing and answer requests, and fees for any independent work such as agreed-upon procedures or a service auditor engagement. Drivers include how many financial processes depend on the provider, how much judgment the output requires, and how many exceptions testing finds. Ask for the scope, deliverables, and which party performs each procedure in any written quote.
How long does it take, and what drives that timeline?
The timeline depends mostly on how much evidence you must build and how quickly the provider responds. Work that depends on your own controls, such as reviewing reconciliations for a sample of periods, usually moves faster than work that needs the provider to run procedures on its own systems. Time also grows with the number of periods in the assessment, the number of financial applications the provider touches, and how long it has been since any prior report period. Agree on a written timeline with milestones and provider response times before testing starts, and confirm it against your year-end close calendar.
Can we test the vendor's controls ourselves?
Often you can test your own controls over the provider's output yourselves, if your team has the skills and access to the data. For example, your team can reconcile the provider's processed transactions to source documents or to your general ledger, and can review exception reports. Testing inside the provider's environment, or procedures that require its records, is harder to do alone because the provider controls access and may limit what you can see. Many organizations split the work: internal staff perform reconciliations and reviews, while an independent firm performs procedures at the provider. Confirm the division with your external auditor so the evidence is one they can rely on.
What happens if the provider refuses access for testing?
A refusal weakens your evidence and can become a control deficiency that your auditor must evaluate. SEC guidance says management must assess controls over outsourced operations, so you cannot treat the provider's refusal as a reason to skip the work. Start by escalating through contract rights, such as audit or information clauses. If those are missing, you can rely more heavily on your own controls over the output, ask the provider to supply reconciliations or reports it already produces, or consider changing providers. Document each request, the response, and your compensating steps, and discuss the position with your auditor early, before year-end.
Do we need outside help to close the gap?
Outside help is optional, and the choice depends on your team's experience with SOX testing and the number of processes involved. An implementation partner can prepare systems, documentation, and evidence packages, and can help design reconciliation or log review controls that you own. An independent firm may perform agreed-upon procedures or other work, depending on the engagement. Only the independent auditor decides whether the evidence supports your assessment, and DeployOpen does not issue audit reports or attestations. Ask any firm to put scope, deliverables, and responsibilities in writing before work begins.
How DeployOpen prepares SOX evidence for outsourced controls
When a SOX-relevant vendor cannot provide a usable SOC 1 Type 2 report, the gap has to be closed with evidence the company itself can produce and test. DeployOpen works inside the client's own infrastructure to prepare the systems, controls and evidence for that work, while management retains ownership of its controls and the external auditor forms the conclusions.
How we scope
- We agree the written scope with you before work starts, naming each outsourced process, system and report in question.
- We confirm which provider outputs feed financial reporting and which controls over them need your own testing.
- Scope, deliverables and timelines are fixed in writing, and any price follows from that written scope.
How we build
- We configure reconciliation and review controls over provider output so each reliance point has a defined owner and frequency.
- We set up logging and access records in your environment so the evidence auditors ask for can be retrieved on request.
- We document each control's design, inputs and expected results so testers can reperform the procedure independently.
How we hand over
- We deliver control narratives, test scripts and evidence index mapped to each provider dependency in the agreed scope.
- We walk your control owners and internal audit through the procedures so they can run them after handover.
- We state clearly which conclusions remain with management and the independent auditor, since DeployOpen does not issue audit reports or certifications.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer if the provider's reporting position changes.
- We can update procedures when a new SOC 1 report arrives, when the provider changes controls, or when auditors request more evidence.
- Ask us to confirm in writing which parts of the work a retainer covers before you sign.
