Do your services impact your clients' financial reporting? If so, you need a SOC 1 report that is reliable for financial statement audits and can withstand scrutiny from your clients' auditors.
Certinova guides you efficiently through the entire process: from the initial readiness assessment and the definition of scope and control objectives to the certified Type 2 report in accordance with ISAE 3402 or IDW PS 951.
Our auditors combine technical expertise with a digital platform that significantly reduces the internal workload for your organization.
Digital workflows and reusable evidence reduce manual effort – especially during re-certification.
Numerous completed audit and assessment projects form the basis of our methodology.
SaaS providers, cloud platforms, IT service providers, and regulated companies rely on Certinova
Regardless of where you are starting from, we provide the right service for your current level of maturity – without detours and without overhead.
We assess your financial reporting-relevant controls against the requirements of ISAE 3402 or IDW PS 951, identify gaps, and prioritize measures. You start with a realistic picture and an actionable roadmap.
Type 1 certifies that your controls are appropriately designed as of the audit date. The ideal starting point to meet initial client requirements and lay the foundation for a future Type 2 report.
Type 2 confirms that your controls function effectively over a defined period—the report that your clients' auditors need for their audit procedures.
SOC 1 can be effectively combined with SOC 2, IDW PS 880, or an internal control system (ICS) assessment. We map controls once, perform one audit, and provide multiple reports—for significantly less effort.
We combine professional assessment by experienced auditors with technology-driven processes.
The result: shorter audit cycles, less internal effort for you, and reports that meet your customers' requirements.
Evidence is collected in a structured manner and automatically validated – the professional assessment remains with our auditors.
Submit documents, answer questionnaires, track status—transparent instead of endless email chains.
A clear audit pattern from scope to report—fewer follow-up questions, predictable effort.
An experienced team supports you beyond the individual report—including follow-up audits and related frameworks.
From the distinction between SOC 1 and SOC 2 to choosing between ISAE 3402 and IDW PS 951, and ensuring acceptance by your clients' auditors—here you will find the answers to the most frequently asked questions during the scoping meeting.
Is your question not listed? Please contact us directly.
SOC 1 focuses on controls that impact your clients' financial reporting—that is, processes relevant to their annual financial statements. SOC 2, by contrast, addresses controls related to security, availability, processing integrity, confidentiality, and privacy. If you process payroll, payment, or accounting data for your clients, SOC 1 is usually the right report. If you offer a SaaS solution without a direct link to financial reporting, the path usually leads to SOC 2. We will clarify which variant—or combination—is right for you during the scoping process based on your clients' requirements.
A Type 1 report confirms that your controls are appropriately designed as of a specific date. A Type 2 report goes further and also assesses whether these controls have operated effectively over an audit period, typically ranging from six to twelve months. Type 1 is suitable as a starting point or if you need documentation on short notice. However, your clients' auditors generally require a Type 2 report, as only this can be used as audit evidence during the financial statement audit.
Both standards pursue the same goal: an audited report on controls within a service organization. ISAE 3402 is the international standard and is primarily expected by clients with cross-border operations or international auditors. IDW PS 951 is the German equivalent and is usually the right choice for clients with German auditors. In practice, reports are often prepared according to both standards in parallel—we will clarify exactly what your clients require during the scoping phase.
SOC 1 reports according to ISAE 3402 or IDW PS 951 are the established standard for service providers whose services impact their clients' financial reporting. The key to acceptance is a well-defined scope, the right control objectives, and a sufficiently long audit period. We align these points with you at the outset—ideally by incorporating the expectations of your most important clients—to ensure the report reaches its intended destination: the audit file of your client's external auditor.
Let's get in touch to discuss your requirements.
