Can I share my SOC 1 with a prospect while we are going through an RFP process?
Yes, distribution of the report is not restricted; however the authorized use or reliance on the report is restricted to specified users. These specified users include the customers (user entities) and their financial statement auditors (user auditors) that used the in-scope system or service as of the report date (for a Type 1 report) or during the review period (Type 2). A prospective user may not place any reliance on the SOC 1 report relevant to their Internal Controls over Financial Reporting.
About the AuthorMore Content by Lauren Edmonds