SOC 1 Reports: What to Ask Your Fund Administrator

Short answer: A SOC 1 report is an independent auditor's report on a service organization's controls that affect its clients' financial reporting. For a fund administrator, it covers controls over things like cash, capital activity, investor records and system access. A Type 2 report tests whether those controls worked over a period, which is why LPs and fund auditors usually prefer it to a Type 1.

SOC reports come up in two places: institutional LP due diligence, and your own fund's audit. Neither GPs nor LPs need to be controls specialists, but you should know what the report is, what it isn't, and what to read first.

For our fund administration service, see the service page.

What is a SOC 1 report?

SOC stands for System and Organization Controls. The AICPA defines a family of reports; SOC 1 focuses on controls at a service organization that are relevant to user entities' internal control over financial reporting (AICPA SOC 1 overview). A fund administrator is a classic service organization: your fund's financial statements depend on its records.

The report is written by an independent CPA firm. It describes the administrator's system, lists control objectives and the controls meant to meet them, and gives the auditor's opinion.

Type 1 vs Type 2

A Type 1 is often a first step for a provider building its controls program. A Type 2 shows the controls actually ran.

SOC 1 vs SOC 2

SOC 2 reports cover controls related to security, availability, processing integrity, confidentiality and privacy. They matter for data protection questions. SOC 1 is the one tied to financial reporting. Some administrators have both. Ask which one answers the question you're trying to answer.

Why do LPs and auditors ask for it?

• Fund auditors may rely on a service organization's controls to plan their work, and a Type 2 SOC 1 helps them do that.

• Institutional LPs ask about administrator controls as part of operational due diligence. See our guide to evaluating fund administrators.

• GPs use it to understand where the administrator's controls stop and their own must start.

What to read first in a SOC 1 report

1. The opinion. Is it unqualified, or are there qualifications or exceptions?

2. The period and scope. Does it cover the services and systems your fund actually uses?

3. Exceptions in testing. What failed, and how did management respond?

4. Complementary user entity controls (CUECs). These are controls the report assumes you run, such as reviewing statements or restricting who can approve payments. If you don't run them, the report's assurance is weaker.

5. Subservice organizations. Which other providers (banks, software vendors) are carved out?

Questions to ask your fund admin

• Do you have a SOC 1 Type 2? What period does it cover?

• If not, what controls documentation can you share, and is a report planned?

• Which controls apply to our fund's services?

• What CUECs do you expect us to perform?

• Were there exceptions, and what changed?

Not every administrator serving emerging managers has a SOC 1 report. If yours doesn't, ask how payment approvals, reconciliations and system access are controlled, and get the answers in writing. The SEC has highlighted control weaknesses at private fund advisers in its risk alert, so LPs will ask.

Controls that matter most for a venture fund

• Separation between who approves payments and who sends them

• Call-back verification for changed wire instructions

• Monthly bank reconciliations reviewed by someone other than the preparer

• Review of capital call and distribution calculations before release

• Access controls on the investor portal and ledger

These apply whether or not a SOC report exists. For more on why independent administration matters, see third party fund administrators.

How a SOC 1 report is structured

Most SOC 1 reports follow a similar layout, so once you've read one you can find what you need quickly in others.

Section 1: The auditor's opinion. The independent service auditor states whether the description is fairly presented and whether controls were suitably designed and, for Type 2, operated effectively. Read this first.

Section 2: Management's assertion. The administrator's management asserts that the description is accurate. It's a formal statement, but it tells you what management is taking responsibility for.

Section 3: The system description. This explains the services, the systems used, the people and processes, and the boundaries of the report. Check that the services your fund uses are inside the boundary. A report covering one product line doesn't help you if your fund runs on another.

Section 4: Control objectives, controls and test results. Each control objective, such as "cash disbursements are authorized" or "investor records are accurately maintained", is listed with the controls meant to achieve it. In a Type 2, the auditor's tests and results are shown next to each control. Look for the word "exception".

Section 5: Other information. Sometimes management adds responses to exceptions or describes future changes. This isn't covered by the opinion, but it's often the most practical part.

Reading exceptions sensibly

An exception doesn't mean the administrator is unsafe. Testing samples dozens of items, and one missed sign-off can appear as an exception. What matters is the pattern and the response:

• Is the exception in a control that matters to your fund, such as payment approval?

• Was it isolated or repeated?

• Did management explain the cause and fix it?

• Did the auditor still conclude the control objective was met?

Bridge letters

A SOC 1 report covers a fixed period. If your fund's year end falls after the period ends, ask for a bridge letter (sometimes called a gap letter). It's management's statement that there have been no material changes to controls between the end of the report period and a later date. It isn't audited, but fund auditors and LPs often ask for it.

What a SOC report can't tell you

A SOC 1 report describes controls; it doesn't tell you whether the administrator is responsive, whether your dedicated contact understands venture funds or how quickly statements are delivered. Combine the report with reference calls and a trial run of the reporting you'll receive.

How Allocations approaches it

At Allocations each fund has a dedicated fund accountant and we support the annual audit, including auditor requests about our processes. Ask us for current controls documentation during diligence. The Fund plan is $19,500 per year, with K-1 preparation as a separate add-on.

Frequently asked questions

What is a SOC 1 report for a fund administrator?

An independent CPA firm's report on the administrator's controls that affect clients' financial reporting, such as controls over cash, capital activity and investor records.

What is the difference between SOC 1 Type 1 and Type 2?

Type 1 assesses control design at a point in time. Type 2 also tests whether controls operated effectively over a period.

Do LPs require a SOC 1 from the fund admin?

Some institutional LPs ask for one in due diligence. Smaller LPs rarely do, but may ask about controls.

Is SOC 2 the same as SOC 1?

No. SOC 2 covers security and related criteria. SOC 1 covers controls relevant to financial reporting.

What are complementary user entity controls?

Controls the report assumes the client runs, like reviewing statements and limiting payment approvers. GPs should check they actually perform them.

What if my fund administrator has no SOC 1?

Ask for written descriptions of key controls, especially payment approvals, reconciliations and access, and whether a report is planned.