SOC 1 Fundamentals Training
A one-day introduction to SOC 1 for Malaysian service organisations and teams reviewing outsourced providers. SOC 1 examines controls at a service organisation that are relevant to its customers' internal control over financial reporting. Using payroll and transaction-processing examples, participants learn why customers ask for the report, what it covers, and how to read its findings.
Who should attend: Finance and payroll teams, shared service centres, service delivery managers, procurement, risk, compliance and internal audit staff. No prior SOC or audit knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
SOC 1 in Plain Language
Follow a payroll transaction from the service provider to a customer's financial records. Identify where errors can affect financial reporting and why SOC 1 differs from SOC 2 and ISO 27001.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Scope, Control Objectives and Responsibilities
Identify the services, systems and people in scope. Match transaction risks to control objectives, approval checks and reconciliations. Introduce complementary user entity controls and responsibilities retained by the customer.
11:30 AM to 12:30 PM
Type 1 and Type 2 Reports
Type 1 addresses the description and suitability of control design at a specified date. Type 2 also addresses operating effectiveness over a period. Learn the roles of management, the service auditor and the report's intended users.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Controls and Everyday Evidence
Recognise evidence of approvals, access reviews, change management, processing checks and reconciliations. Distinguish a documented procedure from evidence that someone performed it.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Reading a Report and Following Up
Locate the scope, management assertion and auditor's opinion. For a Type 2 report, identify tests, exceptions and management responses. Check report dates, subservice organisations and customer responsibilities before relying on the report.
4:00 PM to 5:00 PM
Practical Exercise: Outsourced Payroll
Review a fictional payroll process and an illustrative report extract. Map three risks to controls and evidence, identify customer-side checks, and draft a short list of questions for the provider.
Key Outcomes
- Explain when a SOC 1 report is relevant to outsourced services
- Distinguish SOC 1 from SOC 2 and Type 1 from Type 2
- Match basic financial reporting risks to controls and evidence
- Identify report limitations, exceptions and customer responsibilities
- Prepare an initial control and evidence checklist
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
Relevant to Malaysian financial services, shared service centres and outsourcing providers whose processes affect their customers' financial reporting.
Practical Takeaways
A payroll risk-control worksheet and a provider report review checklist.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
This fundamentals course introduces SOC 1 reporting. A Certificate of Completion is not a SOC 1 attestation report or an auditor qualification. A SOC 1 examination requires an independent licensed CPA firm.
Frequently Asked Questions
Related Fundamentals Training
SOC 2 Fundamentals AI Agent Security & Reliability (AIUC-1) Fundamentals Information Security Management (ISO/IEC 27001) Fundamentals Cybersecurity Risk Management (NIST CSF 2.0) Fundamentals View all fundamentals programmes
Reference material: AICPA: SOC 1 and internal control over financial reporting.