SOC 1 / ISAE 3402 — Controls at a service organization
Assurance over controls relevant to user entities' financial reporting — the report fund administrators are asked for.
- Issued by
- AICPA / IAASB
- Applies in
- Global standards
- Edition
- SSAE 18 / ISAE 3402
- Area
- Information security
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- DESCSystem description complete and accurateDescription
- COControl objectives specified and metControls
- OEOperating effectiveness over the period (Type II)Controls
- CUECComplementary user entity controls communicatedControls
How Amoreg keeps you on it.
Enable the SOC 1 / ISAE 3402 — Controls at a service organization and add AICPA / IAASB’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 4 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read AICPA / IAASB’s pages
- Check the library against 4 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: system description complete and accurate
- Rule
- SOC 1 / ISAE 3402 — Controls at a service organization, DESC
- Area
- Description
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- Cyber EssentialsThe UK government-backed baseline: five technical controls, self-assessed or Plus-audited.United Kingdom · 5 controls
- NYDFS Cybersecurity Regulation (23 NYCRR 500)Cybersecurity requirements for DFS-licensed entities, with CISO, MFA, annual certification and 72-hour notice.United States — New York · 6 controls
- EU Artificial Intelligence ActRisk-based obligations for providers and deployers of AI systems; general-purpose AI duties from August 2025, high-risk from August 2026.European Union · 6 controls
Also in Global standards
- FATF RecommendationsThe 40 Recommendations — the international standard every national AML/CFT/CPF regime is measured against.Global · 8 controls
- Wolfsberg Group StandardsIndustry standards for correspondent banking, the CBDDQ/FCCQ questionnaires and effectiveness-based AML programmes.Global · 4 controls
- ISO 37001 — Anti-bribery management systemsRequirements for establishing, implementing and improving an anti-bribery management system.Global · 6 controls
- ISO 37301 — Compliance management systemsThe certifiable standard for a compliance management system across all obligations.Global · 6 controls
- ISO/IEC 27701 — Privacy information managementThe stand-alone PIMS standard (October 2025 edition), no longer dependent on ISO/IEC 27001.Global · 5 controls
- ISO/IEC 27001 — Information security managementThe certifiable ISMS standard; Annex A controls per ISO/IEC 27002:2022.Global · 9 controls
Questions
Does Amoreg watch for changes to the SOC 1 / ISAE 3402 — Controls at a service organization?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the SOC 1 / ISAE 3402 — Controls at a service organization?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records SSAE 18 / ISAE 3402. Editions were last verified in August 2026, and the Monitor records new publications as they appear.