SOC 1 Type 2 Report: What It Covers, Type 1 vs Type 2, and How to Prepare
A SOC 1 Type 2 report tells your customers' auditors that your controls over their financial data worked over a period of time. Here is what it tests, how it differs from Type 1, and how to get ready for your first examination.
A customer's finance team emails a short request: please send your SOC 1 Type 2 report before our year-end audit. If you run payroll, billing, claims or investment systems for clients, this request will come. Their external auditor needs evidence that your controls worked. A SOC 1 report is the standard way to provide it.
This guide explains what the report is and how it differs from Type 1 and from SOC 2. It also covers what the report contains and how to plan the review period.
Quick answer: A SOC 1 Type 2 report is a CPA firm's opinion on a service organization's controls that affect its customers' internal control over financial reporting (ICFR). It covers your system description, the design of your controls, and whether they worked over a period. That period is usually 6 to 12 months. The examination follows the AICPA standard SSAE 18 (AT-C 320), and the report is written for your customers and their auditors.
What Is a SOC 1 Type 2 Report?
The AICPA describes SOC 1 as an examination of service organization controls likely to be relevant to user entities' financial reporting. User entities are your customers. User auditors are the CPAs who audit your customers' financial statements.
The Type 2 report answers the question those auditors care about. Did the controls behind our client's financial numbers work all year? Public companies rely on it for Sarbanes-Oxley Section 404 testing, and private companies' auditors use it in the same way. The examination is performed by a licensed CPA firm under SSAE 18, which replaced SSAE 16 for reports dated on or after 1 May 2017.
Who needs one
Payroll, benefits and claims processors, loan servicers, fund administrators, billing and revenue platforms, and data centres hosting financial systems.
Who reads it
Your customers' controllers and internal auditors, and their external financial statement auditors.
Who issues it
A licensed CPA firm, under the AICPA attestation standards. No certification body can issue a SOC report.
International twin
Outside the US, the same kind of report is often issued under ISAE 3402.
SOC 1 Type 1 vs Type 2
Both types describe your system and assess control design. Only Type 2 tests whether the controls ran as described, by sampling evidence across a period.
| Type 1 | Type 2 | |
|---|---|---|
| Covers | One date | A period, usually 6 to 12 months |
| Opinion on | System description and control design | System description, control design and operating effectiveness |
| Testing | Walkthroughs of how controls are designed | Samples of evidence from across the whole period |
| Best for | A first report, or proving design before a period starts | What most user auditors ask for, year after year |
| Limitation | Says nothing about whether controls actually worked | Takes longer, because the period must pass first |
Many first-time service organizations issue a Type 1 report, then move to a Type 2 report for the following period. If a customer's year-end is close, ask their auditor what they will accept in the meantime.
Not sure whether your customers need SOC 1 or SOC 2? Our SOC services page compares SOC 1, SOC 2 and SOC 3 side by side.
See SOC 1 and SOC 2 servicesSOC 1 Type 2 vs SOC 2 Type 2
The two are often confused because both come in Type 1 and Type 2. The difference is the subject. SOC 1 is about financial reporting. SOC 2 is about security and the other Trust Services Criteria.
| SOC 1 | SOC 2 | |
|---|---|---|
| Focus | Controls relevant to customers' financial reporting | Security, availability, processing integrity, confidentiality and privacy |
| Measured against | Control objectives you define with your auditor | The AICPA Trust Services Criteria |
| Main reader | Customers' controllers and financial auditors | Customers' security and vendor-risk teams |
| Typical trigger | A customer's year-end audit or SOX testing | A security questionnaire or enterprise sales deal |
Some service organizations need both, for example a payroll platform that also holds sensitive employee data. Read our SOC 2 compliance services guide for the SOC 2 side. If international customers also ask for ISO 27001, see ISO 27001 vs SOC 2. Platforms holding employee or customer personal data may add ISO 27701 for privacy.
What a SOC 1 Type 2 Report Contains
Most Type 2 reports follow the same structure. Knowing it helps you prepare the parts your team writes.
- 01Independent service auditor's reportThe CPA firm's opinion on the description, the design of controls and their operating effectiveness over the period.
- 02Management's assertionA signed statement from your management that the description is fair and the controls were suitably designed and operated effectively.
- 03System descriptionYour services, systems, people, processes, control objectives and the controls that meet them. Your team writes this section.
- 04Tests of controls and resultsEach control, how the auditor tested it, and any exceptions found.
- 05Other information (optional)Unaudited material from management, such as responses to exceptions.
SOC 1 Control Objectives and Who Owns Each Control
A SOC 1 report is scoped around control objectives, not a fixed list. You and your auditor agree objectives that matter to your customers' financial data. Typical ones are that transactions are authorized, processed completely and accurately, and reported on time. IT general controls, such as logical access, change management and job monitoring, usually support them.
Two other terms appear in almost every report. Complementary user entity controls (CUECs) are controls your customers must run themselves, such as reviewing payroll reports before approval. Subservice organizations are vendors you rely on, such as a hosting provider. The report either includes their controls (the inclusive method) or excludes them and lists what you rely on them for (the carve-out method). Most reports use the carve-out method.
Choosing the Review Period and Using Bridge Letters
Most Type 2 reports cover 12 months, and some cover as little as six. AICPA guidance quoted by Linford & Co. says the period should typically overlap the user entity's audit period by at least six months.
Pick a period that ends shortly before most customers' year-ends. If most customers close on 31 December, a period ending 30 September or 31 October works well. It leaves time to issue the report before their auditors start. For the months between your period end and their year-end, you issue a bridge letter. It is a short letter from management stating whether controls changed since the period ended, and it is not audited.
Planning your first SOC report?
Our SOC 2 checklist walks through the evidence auditors sample. Most of the IT general controls apply to SOC 1 too.
How to Prepare for Your First SOC 1 Examination
- 01Ask customers what they needConfirm which services and systems their auditors care about, and their year-ends.
- 02Define the scopeList the services, systems, locations and subservice organizations in scope.
- 03Agree control objectivesMap each objective to the business process and IT general controls that meet it.
- 04Run a readiness assessmentFind gaps in design and evidence before the period starts, while fixes are cheap.
- 05Start the period and keep evidenceApprovals, reconciliations, access reviews and change tickets need to exist for every month.
- 06Write the system descriptionDraft it during the period so it matches what actually happens.
- 07Fieldwork, report and bridge letterThe CPA firm tests samples, issues the report, and you answer bridge-letter requests until the next period.
Common SOC 1 Exceptions Auditors Find
Exceptions are cases where a sampled control did not work as described. They appear in the report, and user auditors read them closely.
- Late or missing access reviews: a quarterly review skipped once is enough to create an exception.
- Terminated users left active: leavers not removed within the time your description promises.
- Changes without approval evidence: production changes with no recorded approval or testing.
- Reconciliations not signed off: work done, but no reviewer evidence.
- Descriptions that promise too much: a control described as daily that really runs weekly.
Write the description to match reality, then run controls on a calendar with owners. That prevents most exceptions.
SOC 1 Reports with Accredify Global
Accredify Global handles everything up to the attestation. That covers scoping, gap analysis, control design support, evidence operations and a quality review before testing. A licensed CPA partner firm then performs the SOC 1 examination and signs the report, because only a CPA firm may do that. You get one tailored proposal that includes the CPA firm's fee.
Many of our SOC clients also need an accredited ISO certificate. Accredify Global is a UAF-accredited certification body for ISO 27001 certification and 11 other standards. Financial services firms can read our ISO certification for financial services guide, software providers our SaaS compliance page, and healthcare platforms our HITRUST certification page. To see how certification differs from attestation, read what an ISO certification body is, or browse all our compliance services.
Need a SOC 1 Type 2 report before a customer's year-end?
Tell us your services, systems and customers' year-ends. We'll suggest the scope and review period, and send one tailored proposal that includes the CPA firm's examination.
Book your free readiness call →SOC 1 Type 2 Report FAQ
What is a SOC 1 Type 2 report?
It is a licensed CPA firm's opinion on a service organization's controls that are relevant to its customers' financial reporting. It covers the system description, control design, and whether the controls operated effectively over a period, usually 6 to 12 months.
What is the difference between SOC 1 Type 1 and Type 2?
A Type 1 report covers control design at a single date. A Type 2 report also tests whether the controls operated effectively across a period. Most user auditors ask for Type 2.
What is the difference between SOC 1 Type 2 and SOC 2 Type 2?
SOC 1 covers controls relevant to customers' financial reporting and is read by their financial auditors. SOC 2 covers security and the other Trust Services Criteria and is read by security and vendor-risk teams.
Who needs a SOC 1 Type 2 report?
Service organizations whose systems affect customers' financial data. Examples are payroll, benefits, claims and billing providers, loan servicers, fund administrators and data centres.
How long is a SOC 1 review period?
Most cover 12 months and some cover six. AICPA guidance says the period should typically overlap the customer's audit period by at least six months.
What is a SOC 1 bridge letter?
A short, unaudited letter from management covering the gap between the end of the review period and a customer's year-end. It states whether controls changed since the period ended.
Which standard governs SOC 1 reports?
SOC 1 examinations follow the AICPA attestation standard SSAE 18 (AT-C 320), which replaced SSAE 16 for reports dated on or after 1 May 2017. Outside the US, ISAE 3402 is the closest equivalent.
What are complementary user entity controls?
They are controls the service organization assumes its customers will run themselves, such as reviewing reports before approving payments. They are listed in the report so customers know their part.
Is a SOC 1 report a certification?
No. A SOC 1 report is an attestation with a CPA firm's opinion. There is no certificate and no pass mark, and only a licensed CPA firm can issue it.
Does Accredify Global provide SOC 1 Type 2 reports?
Yes. Accredify Global handles scoping, readiness and evidence, and a licensed CPA partner firm performs the examination and signs the report. You receive one tailored proposal that includes the CPA firm's fee.