SOC 1 Report Reviewer

How it works

Input

The current-year SOC 1 report (PDF), plus last year's review data if this is a repeat engagement

What it does

Classifies the auditor's opinion → pulls out every control objective, control, and exception → drafts each judgment as a proposal for the reviewer → maps complementary user-entity controls to the service organization's controls → identifies subservice organizations → fills in the workbook

What has to hold true

70 checks run as live formulas in the workbook — including recomputing period coverage from the report dates — and every one was shown capable of failing before the package shipped. Every judgment stays a proposal until the reviewer confirms it.

The part that makes it reproducible

Output

A completed, ready-to-review 13-tab SOC 1 review workpaper

What it's made of

Each step runs on its own, so you can see — and stop at — any stage.

1. 1

   soc1-extract

   Pulls the control objectives, controls, testing exceptions, complementary user-entity controls, subservice organizations, and the auditor's opinion straight out of the PDF.

2. 2

   soc1-assess

   Drafts every judgment call the reviewer has to make — which control objectives matter, which user-entity controls apply, whether the service auditor's testing was adequate — each as a proposal with a confidence level and the source text behind it, so the reviewer confirms instead of starting from a blank grid.

3. 3

   soc1-diff

   Compares this year's report against last year's review — repeat exceptions first, then scope changes and subservice organizations that came or went.

4. 4

   soc1-review

   Fills in Auditshore's standard 13-tab review workbook, where every field names the standard that requires it and 70 checks run as live formulas.