Choosing between a SOC 1 Type 1 or Type 2 report depends on what customers and their financial statement auditors need to know about a service organization’s controls. Type 1 evaluates control design and implementation as of a specified date, while Type 2 also evaluates whether those controls operated effectively over a specified period.
Key Takeaways
- SOC 1 reports address controls relevant to customers’ financial reporting.
- Type 1 evaluates controls as of a specified date.
- Type 2 evaluates controls and their operating effectiveness over a specified period.
- A company does not always need to complete Type 1 before beginning Type 2.
- Customer and user-auditor requirements should guide the decision.
What is a SOC 1 report?
A SOC 1 report addresses controls at a service organization that are relevant to customers’ internal control over financial reporting. Customers and their financial statement auditors may use the report to understand how an outsourced service could affect financial transactions, records, account balances, or disclosures.
SOC 1 reports commonly apply to payroll processors, third-party administrators, claims administrators, loan servicers, payment processors, and other organizations that perform financial or transaction-related services for customers.
What is a SOC 1 Type 1 report?
A SOC 1 Type 1 report evaluates management’s description of the service organization’s system and whether the relevant controls are suitably designed and implemented as of a specified date.
Type 1 provides point-in-time information. It may be appropriate when an organization needs an initial SOC 1 report, has recently implemented controls, or has a customer that specifically requests assurance as of a particular date.
A Type 1 report does not provide an opinion about whether the controls operated effectively over an extended period.
What is a SOC 1 Type 2 report?
A SOC 1 Type 2 report addresses the same financial-reporting control objectives as Type 1, but it also evaluates whether the controls operated effectively throughout a specified period.
The CPA performs tests of controls and includes the testing procedures and results in the report. This gives customers and their auditors information about how the controls functioned over time rather than only whether they were in place as of one date.
Professional standards do not establish a universal six-month minimum for every Type 2 engagement. The reporting period should be determined based on the engagement circumstances, customer requirements, and the amount of operating evidence available.
SOC 1 Type 1 vs. Type 2
| Comparison Area | SOC 1 Type 1 | SOC 1 Type 2 |
|---|---|---|
| Time covered | A specified date | A specified period |
| Control evaluation | Design and implementation | Design, implementation, and operating effectiveness |
| Evidence needed | Evidence showing controls were implemented by the specified date | Evidence showing controls operated throughout the reporting period |
| Common purpose | Initial or point-in-time assurance | Ongoing assurance about control performance |
| Operating-effectiveness testing | Not included | Included for the specified reporting period |
| Important question | Does the customer need assurance as of a particular date? | Does the customer need evidence that controls operated effectively over time? |
How should a company choose SOC 1 Type 1 or Type 2?
Start by asking the customer or its auditor which report is required. A service organization should not assume that Type 1 will satisfy a request for Type 2 or that every customer expects the same reporting period.
The organization should also consider whether its controls have been operating consistently and whether sufficient evidence has been retained. A Type 2 examination requires evidence covering the reporting period, including approvals, reconciliations, access reviews, transaction records, monitoring results, and other documentation relevant to the controls being tested.
A Type 1 report can be a practical first step when the controls were recently implemented or the organization needs point-in-time assurance. However, completing Type 1 is not automatically required before beginning Type 2.
What should be confirmed before the SOC 1 examination?
Before choosing SOC 1 Type 1 or Type 2, the service organization should answer several questions:
- Which customers and auditors will use the report?
- Which services and financial-reporting risks must be included?
- Does the customer require Type 1 or Type 2?
- What reporting date or period is expected?
- Which controls address the relevant control objectives?
- Have the controls been performed consistently?
- Is complete supporting evidence available?
- Are any subservice organizations involved in delivering the service?
Clarifying these requirements before the engagement begins can reduce scope changes, missing evidence, and reporting delays.
Explore SOC Report Options
- SOC Audit Services
- SOC 1 Type 1 Report
- SOC 1 Type 2 Report
- SOC 2 Type 1 Report
- SOC 2 Type 2 Report
- SOC 2 Type 1 or Type 2: Which Should You Choose?
Helpful Resources
Frequently Asked Questions
What is a SOC 1 report?
A SOC 1 report addresses controls at a service organization that are relevant to customers’ internal control over financial reporting.
What is the difference between SOC 1 Type 1 and Type 2?
Type 1 evaluates control design and implementation as of a specified date. Type 2 also evaluates whether the controls operated effectively throughout a specified period.
Does SOC 1 Type 1 test operating effectiveness?
No. Type 1 evaluates whether controls are suitably designed and implemented as of the specified date, but it does not test their operating effectiveness over a period.
Does a company need SOC 1 Type 1 before Type 2?
No. A company may begin with Type 2 when its controls are established, supporting evidence is available, and Type 2 meets the report users’ requirements.
Is there a required six-month minimum for SOC 1 Type 2?
Professional standards do not establish a universal six-month minimum for every engagement. The reporting period should reflect the engagement circumstances and report-user requirements.
Who uses a SOC 1 report?
Customers and their financial statement auditors commonly use SOC 1 reports to understand controls related to outsourced services that may affect financial reporting.
Which organizations commonly need SOC 1 reports?
Payroll processors, third-party administrators, claims administrators, loan servicers, payment processors, and other organizations that affect customer financial reporting may need SOC 1 reports.
Which SOC 1 report is right for my organization?
The appropriate report depends on customer requirements, control readiness, available evidence, the required reporting date or period, and whether users need operating-effectiveness testing.
Take the Next Step
The appropriate report should meet customer and auditor requirements without overstating the organization’s readiness. Contact MeredithCPAs to determine whether SOC 1 Type 1 or Type 2 is appropriate for your services, controls, and reporting deadline.
About MeredithCPAs
At MeredithCPAs, we provide accounting and auditing, tax, and consulting services for businesses, organizations, individuals, and families. Based in Irving, our experienced team serves organizations throughout Dallas-Fort Worth, across Texas, and in multiple states. Long-standing client relationships and low employee turnover help us deliver consistent service and practical guidance based on each client’s circumstances.
Related Business and Financial Resources
- SOC 2 Type 1 or Type 2: Which Should You Choose?
- What Is a SOC Bridge Letter and When Is One Needed?
- Can a Smaller Organization Complete a SOC Examination?
- Which Dallas Organizations May Need a SOC Report?
- When Might a Plano Company Need a SOC Report?