SOC 1 Reviewer

Record each subservice organisation named in the report. Under the carve-out method its controls are excluded from the service auditor's opinion, so its own SOC 1 report (and coverage of the complementary subservice organisation controls, CSOCs) must be tracked. Under the inclusive method its controls are in scope of this report.

A service organisation may issue an updated report later in the year. Each report is held as a separate version of this review, tiled by period. A signed-off version is locked: it is never edited — further notes are recorded as dated addenda, and an updated report starts a new version.

A bridge (gap) letter is a management representation from the service organisation covering the period between the report period end and your audit period end. It is not audited. Record the letter received and your review of each change it discloses.

CUECs are controls that the service organisation assumes the user entity (your organisation) has in place. You must assess whether each CUEC is implemented.

Optionally upload your own SOC 1 review template. Its structure is then used as the memorandum skeleton instead of the built-in structure; the default premium memorandum is used when no template is provided. Text templates (.txt, .md) are read directly; for .docx/.xlsx templates the file is kept as the review's template reference and its section text can be pasted below.