To review a SOC 1 report, check five things in order: that it covers the right legal entity and the services your funds actually receive; that its period overlaps your financial year, and what fills the gap after it; what the opinion says and whether it is modified; which controls are excluded, through carved-out subservice organizations or controls the report expects you to run; and every deviation in the tests, read against the errors your own funds suffered. The last step is the one most reviews skip, and it is the one that matters, because a SOC 1 opinion is about the administrator's controls over a period, not about your fund's numbers. A clean opinion can sit beside wrong NAVs. Botminds' Fund Administration Oversight is built around that gap: its Controls agent reads each administrator's report for opinion, period, exceptions with their page and subservice organizations, and links each exception to the restrikes and breaks the fund actually saw, so the review ends in a grade a person signs.
A clean opinion is not a clean NAV: the four combinations a SOC 1 review has to sort
Clean report · NAVs right
The comfortable case
Controls operated as described and the fund saw no errors they would have caught. Keep the evidence; it is what the CCO's annual report rests on.
Clean report · NAVs wrong
The case a review exists for
The opinion is unqualified, yet the fund paid for restrikes. Look for a deviation the auditor reported but judged not to defeat the objective, a carved-out provider, a gap after the period, or a complementary control the fund did not run.
Exceptions · NAVs right
Read, then decide
Exceptions do not by themselves make the report useless. If none touches a process your funds use, or none produced an error you saw, record why and move on.
Exceptions · NAVs wrong
Join them
An exception with the same cause as your errors is a finding about the administrator, a likely material compliance matter, and the basis for a remediation request.
What is a SOC 1 report, and what does its opinion actually cover?
A SOC 1 report is an independent auditor's report on a service organization's controls that are relevant to its clients' financial reporting. The AICPA describes SOC 1 as an examination of a service organization's controls that bear on its clients' internal control over financial reporting, performed under its attestation standard AT-C section 320 and written for those clients and their auditors (AICPA, SOC 1). For a fund, the service organization is the administrator and the user entity is the fund.
The international equivalent, ISAE 3402, spells out what the auditor actually opines on in a type 2 report. Three things, each "throughout the specified period": that the administrator's description of its system fairly presents the system as designed and implemented; that the controls related to the stated control objectives were suitably designed; and that those controls operated effectively (ISAE 3402, paragraph 8). Every element of that sentence is the administrator's own: its description, its control objectives, its controls. Your NAVs appear nowhere in it.
The description is also not tailored to you. ISAE 3402 acknowledges that it "is prepared to meet the common needs of a broad range of user entities and their auditors and may not, therefore, include every aspect of the service organization's system that each individual user entity and its auditor may consider important in its particular environment." If your funds use a process the administrator runs for few clients, such as a particular derivative, an unusual fee or a share class mechanism, the report may simply not describe it.
How to review a SOC 1 report, step by step
A SOC 1 review checklist should end in a decision, not a filed PDF: rely on the report as it stands, rely on it with compensating work, or treat the administrator's controls as unevidenced for some services. The ten checks below are the ones that change that decision.
SOC 1 report review checklist for a fund administrator: ten checks that change the conclusion
- Right entity, right services
The legal entity in the report is the one in your administration agreement, and the services described include those your funds receive, in the locations that perform them.
- Type 2, not type 1
A type 1 report covers design "as at a specified date" with no testing of operation. For reliance over a year, you need a type 2.
- Period overlap with your fund year
Note the months of your financial year the report does not cover, and what evidence covers them.
- The opinion, and any modification
An auditor modifies the opinion when the description is not fairly presented, controls were not suitably designed or did not operate, or evidence was insufficient. Read the reasons in full.
- Parts of the description not covered by the opinion
The report must identify them. Anything outside the opinion is unevidenced.
- Subservice organizations: inclusive or carved out
Pricing feeds, hosting and print vendors are often carved out, so their controls were not tested. Ask what monitors them.
- Complementary user entity controls
List every control the report assumes you run. The objectives are achieved only if you do.
- Every deviation, with its sample
Deviations are reported even when the auditor concluded the objective was achieved. Read the count, the sample size and the nature of each.
- Your errors against their exceptions
Put the quarter's restrikes, breaks and incidents beside the deviations. Same cause, same process, same months: that is a finding.
- Management's response, with a date
A response that names a fix and an effective date can be followed up; one that says the matter is "being reviewed" cannot.
Two of those checks are about controls the report does not cover at all, carved-out providers and the controls the administrator expects the fund to run. They are the half of the report that is the fund's to evidence, and complementary user entity controls, with examples works through them one by one.
What is a SOC 1 Type 2 report, and how much of your year does it cover?
A SOC 1 type 2 report covers the design and the operating effectiveness of the administrator's controls over a stated period, usually twelve months, with a description of the auditor's tests and their results. The period is the catch. An administrator's report year rarely matches each client's financial year, and it is delivered after its period ends, so for some months of any fund's year the latest report is out of date.
The user auditor's standard says what that costs. "For certain assertions, the shorter the period covered by a specific test and the longer the time elapsed since the performance of the test, the less audit evidence the test may provide," and a report "offers less audit evidence if there is little overlap" with the period being relied on (ISA 402, paragraph A32). If the testing period is entirely outside the fund's reporting period, the user auditor "will be unable to rely on such tests" without other procedures (paragraph A35).
One fund year, three administrator reports: how much each one actually covers
- Covered by the report
- Gap: bridge letter only
- Covered
- Gap: bridge letter only
- Covered by the report
The months after the period are usually covered by a bridge letter, sometimes called a gap letter. It is a letter from the administrator's own management saying whether its controls changed since the period ended. It is useful and should be requested every time, but it carries no auditor's testing: ISAE 3402 states that the service auditor "has no obligation to perform any procedures regarding the description of the service organization's system, or the suitability of design or operating effectiveness of controls, after the date of the service auditor's assurance report" (paragraph 44). For those months, the fund's own evidence of how the administrator performed is the only tested evidence there is.
What do you do with an exception in a SOC 1 report?
Read it, size it against your own errors, and decide; an exception is neither a pass nor a fail on its own. The user auditor's standard says so: exceptions or a modified opinion "do not automatically mean that the service auditor's type 2 report will not be useful", and are instead considered in assessing the testing performed (ISA 402, paragraph A38). The service auditor's side of the rule is what makes a clean report worth reading line by line.
The service auditor shall report deviations even if, on the basis of tests performed, the service auditor has concluded that the related control objective was achieved.
ISAE 3402, paragraph 54
That sentence is why a clean opinion can carry the explanation for your restrikes. The auditor samples a daily control, finds a few days without evidence, judges the objective still achieved and reports the deviation in the test section, many pages after the opinion. If those days are days your funds were mispriced, the deviation is the cause of your errors, and the opinion is beside the point.
Take the sample firm in Fund Administration Oversight, the fictional Quillfield Capital, and its administrator Pellmont. Pellmont's SOC 1 type 2 report for July 2025 to June 2026 runs to 164 pages with an unqualified opinion on page 4. On page 88, control 6.2, the daily review of the stale-price report, had no evidence of review for 3 of 40 days sampled. In the third quarter the fund had seven NAV restrikes, and four came from bond prices left unchanged that nobody investigated. The Controls agent linked the deviation to those four, which is why the solution's rubric made Controls a C rather than a B.
A SOC 1 exception on page 88, joined to the four restrikes it explains
After the exception: the grade, the CCO and next year's questions
The exception then has three uses. It goes into the administrator's grade and the remediation request, with the page cited. It is a candidate material compliance matter for the CCO, because Rule 38a-1 treats a weakness in the implementation of an administrator's procedures as one where the board would need to know; who answers for the administrator under Rule 38a-1 sets out that chain. And it becomes a question for next year's tender or due diligence: what changed, and what evidence shows it.
ISAE 3402 vs SOC 1, and SOC 1 vs SOC 2
ISAE 3402 and SOC 1 are the same kind of report under two standard-setters. ISAE 3402 is the International Auditing and Assurance Standards Board's standard, effective for reports covering periods ending on or after June 15, 2011; SOC 1 is the AICPA's report, examined under AT-C section 320. In the sample firm in Fund Administration Oversight, the Luxembourg administrator's report is an ISAE 3402 and the US administrators' are SOC 1s, and the Controls agent reads both the same way. A SOC 2 report is a different product: it reports on controls against the AICPA's trust services criteria, not on controls relevant to financial reporting.
ISAE 3402 vs SOC 1: what changes and what does not
ISAE 3402: International Auditing and Assurance Standards Board (IAASB)
SOC 1: AICPA, attestation standard AT-C section 320
ISAE 3402: Controls at a service organization "likely to be relevant to user entities' internal control as it relates to financial reporting"
SOC 1: Controls at a service organization relevant to its clients' internal control over financial reporting
ISAE 3402: Type 1: description and design at a date. Type 2: description, design and operating effectiveness over a period, with tests and results.
SOC 1: The same two types, the same distinction
ISAE 3402: User entities and their auditors, read "along with other information including information about controls operated by user entities themselves"
SOC 1: User entities and the CPAs who audit them
ISAE 3402: Read it exactly as a SOC 1: entity, services, period, opinion, carve-outs, complementary controls, deviations
SOC 1: Read it exactly as an ISAE 3402
What a SOC 1 cannot tell you: the administrator that only compiled
A controls report tests the controls the administrator chose to describe. It cannot test the judgment an administrator never exercised. The SEC's 2023 order against Theorem Fund Services describes an administrator that "had minimal policies or procedures regarding accounting practices to follow when calculating a fund's NAV", booked trading losses as a receivable from the manager at the manager's direction, and sent investor statements that carried, in bold, the description "Independent Fund Administrator" (SEC, Release 33-11218, 2023). The order does not mention a SOC 1 report; the point is that the word independent described a structure, not a check.
Research on hedge funds points the same way. Cassar and Gerakos, studying the mechanisms funds use to price positions and report performance, found that using reputable administrators and auditors was not associated with less smoothing of reported returns, while less verifiable pricing sources and more manager discretion over prices were (Review of Financial Studies, 2011). The presence of a good administrator, evidenced by a good report, is a different fact from the prices in your NAV being right. A review that wants the second has to bring the fund's own records to the table.
How Fund Administration Oversight reads a SOC 1 report
The Controls agent reads each SOC 1 type 2 or ISAE 3402 report and its bridge letter for the opinion, the period, every exception with its page, management's responses and the subservice organizations, then links each exception to the restrikes, breaks and incidents in the fund's own records. It may not mark a complementary control as run without evidence, and it may not accept a report with a coverage gap: an overdue report puts Controls at I, incomplete, rather than counting as clean.
The Controls grade on a report card: the exception, the restrikes and the rubric clause
The output is the material the CCO's annual report and the next tender both need: what the report covered, what it found, which findings touched the fund, and what the administrator committed to fix. A fund administration RFP that asks for things that can fail uses the same evidence when an administrator is being chosen or replaced.
Questions people ask
How long is a SOC 1 report valid?
It has no expiry date; its value fades with distance from its period. ISA 402 says a test gives less evidence the longer ago it was performed and the less its period overlaps the one being relied on, so a fund should track the gap after each report's period and ask for a bridge letter to cover it.
Who is allowed to read a SOC 1 report?
It is intended for the service organization's clients and their auditors. ISAE 3402 requires the report to state that it is intended only for user entities and their auditors who have a sufficient understanding to consider it, along with information about controls the user entities run themselves.
What is a SOC 1 report review template?
A one-page record per report: entity and services, type, period and the gap to your year-end, opinion and modifications, carved-out providers, complementary controls with owners, each deviation with its sample and your matching errors, management's response, and a conclusion signed by a named reviewer. The checklist above gives the ten fields that change the conclusion.
Can a SOC 1 opinion be qualified?
Yes. Under ISAE 3402 the auditor modifies the opinion if the description is not fairly presented, the controls were not suitably designed, the tested controls did not operate effectively, or the auditor could not obtain enough evidence, and must describe every reason. A qualified opinion on a process your funds use is a matter for the CCO, not just the file.
Does the fund's auditor rely on the administrator's SOC 1?
Often, as evidence about the administrator's controls. Under ISA 402 an auditor relying on the report must judge its period, test the relevant complementary controls the fund runs, and evaluate whether the tests are relevant to the fund's statements, and may not refer to the service auditor's work in an unmodified opinion on the fund.
What if the administrator uses AI in its processes?
The AICPA has issued technical questions and answers, in Q&A section 9561, on the effect of a service organization's use of AI on a SOC 1 examination under AT-C section 320. Ask whether any control in the report is performed by an AI system and how the service auditor tested it.