SOC 1 vs SOC 2: What Each Report Covers, Who Reads It, and Which One Your Customers Need

A payroll software company gets two requests in the same week. A customer's controller writes: "Our external auditors need your SOC 1 Type 2 before year-end." A new prospect's security team writes: "Please send your SOC 2 report." The founder's first question is whether one report can answer both.

Usually it cannot. SOC 1 and SOC 2 share a name, a format and an issuer, but they test different controls for different readers. This guide explains the difference and how to choose.

Quick answer: A SOC 1 report covers a service organization's controls that affect its customers' internal control over financial reporting, and is read by customers' finance teams and their auditors. A SOC 2 report covers controls for security, availability, processing integrity, confidentiality and privacy, measured against the AICPA Trust Services Criteria, and is read by customers' security and procurement teams. Both are issued only by licensed CPA firms, both come in Type 1 and Type 2, and both are restricted-use reports. SOC 3 is the public summary version of SOC 2.

SOC 1 vs SOC 2 vs SOC 3: Side-by-Side

What a SOC 1 Report Covers

SOC 1 exists because your customers' auditors need to rely on controls that sit inside your organization. If you process their payroll, invoices or transactions, errors in your systems flow straight into their financial statements. A SOC 1 report gives those auditors, called user auditors, an independent opinion on your control objectives, such as "payroll changes are authorized and processed accurately", and the business process and IT general controls that meet them.

SOC 1 matters most when your customers are public companies, because their auditors test internal control over financial reporting for SOX. See how that fits on our SOX compliance page, and read the full guide to the SOC 1 Type 2 report.

What a SOC 2 Report Covers

SOC 2 reports on the controls that protect your customers' data and keep your service running, measured against the AICPA Trust Services Criteria. Security is included in every SOC 2 report. Availability, processing integrity, confidentiality and privacy are added when your service commitments call for them.

• Security. Access control, change management, monitoring and incident response.
• Availability. Capacity, backups, disaster recovery and tested restores.
• Processing integrity. Complete, accurate and timely processing, for example of payments.
• Confidentiality. Classification, restricted access and secure disposal of confidential data.
• Privacy. Notice, consent, collection, use, retention and disposal of personal information.

SOC 2 is the report most SaaS and cloud buyers request in security reviews. Comparing it with a certifiable standard? Read ISO 27001 vs SOC 2.

Type 1 vs Type 2 Applies to Both

For SOC 1, pick a Type 2 period that ends shortly before most customers' year-ends, so their auditors receive the report in time. For SOC 2, see typical routes, costs and timelines in our guide to SOC 2 compliance services.

Inside the Report: What Readers Look For

• The auditor's opinion. Unqualified, qualified, adverse, or a disclaimer of opinion. Readers check this first.
• Exceptions. Type 2 reports list any test exceptions, with management's response.
• Subservice organizations. Providers such as your cloud host are either carved out, so readers need that provider's own report, or included in your report.
• Complementary user entity controls. The controls your customers must run themselves for your controls to work, such as reviewing their own users' access.
• The period or date. If the report is older than the reader needs, they will ask for a bridge letter.

A bridge letter, sometimes called a gap letter, covers the months between the end of your last report period and the date a customer needs assurance. Your management writes it, it states whether controls changed, and the CPA firm does not audit it.

Which Report Do You Need?

Selling software into regulated buyers? See SaaS compliance or compliance for banking and financial services. Healthcare buyers may also ask for HITRUST.

Planning SOC 1 and SOC 2 Together

When you need both, many controls overlap: user access, change management, backups, incident response and vendor management. Plan both examinations on the same period where possible, build one evidence calendar, and write each system description for its own reader. SOC 1 needs control objectives tied to financial processes. SOC 2 needs the Trust Services Criteria you selected. Our SOC 2 checklist covers the evidence a CPA firm commonly samples, and most of the IT general controls apply to SOC 1 too.

Who Issues SOC Reports, and What Accredify Global Does

Only a licensed CPA firm can perform a SOC examination and sign the report, because AICPA standards require it. A certification body cannot issue a SOC report, and anyone promising a SOC 2 "certificate" without a CPA firm is not offering a real report. Accredify Global handles scoping, gap analysis, control design and evidence, then coordinates the examination with a licensed CPA partner firm, whose fee is included in one fixed-fee proposal.

SOC 1 vs SOC 2 FAQ

What is the difference between SOC 1 and SOC 2?
A SOC 1 report covers a service organization's controls that are relevant to its customers' internal control over financial reporting, such as payroll, billing or claims processing. A SOC 2 report covers controls for security, availability, processing integrity, confidentiality and privacy, measured against the AICPA Trust Services Criteria. SOC 1 is read mainly by customers' finance teams and their auditors. SOC 2 is read by customers' security and procurement teams.

Which is better, SOC 1 or SOC 2?
Neither is better. They answer different questions. If your service affects your customers' financial statements, their auditors will ask for SOC 1. If customers trust you with their data or systems, their security teams will ask for SOC 2. Ask the customer which report their reviewers need before you scope anything.

Do I need both SOC 1 and SOC 2?
Some companies do. A payroll, billing or payments platform often needs SOC 1 for its customers' financial auditors and SOC 2 for their security reviews. The two examinations can be planned together so shared controls, such as access management and change management, are prepared and evidenced once.

What is a SOC 3 report?
A SOC 3 report is a short, general-use report based on the same Trust Services Criteria as SOC 2, without the detailed description of tests and results. Because anyone can read it, companies often publish it on their website and share the full SOC 2 report under a nondisclosure agreement.

Who can issue a SOC 1 or SOC 2 report?
Only a licensed CPA firm, under AICPA attestation standards. SOC 1 examinations follow SSAE 18, AT-C section 320. SOC 2 and SOC 3 examinations follow AT-C sections 105 and 205. A certification body cannot issue a SOC report. Accredify Global handles scoping and readiness and coordinates the examination with a licensed CPA partner firm.

What is the difference between Type 1 and Type 2?
Both SOC 1 and SOC 2 come in two types. A Type 1 report gives an opinion on the system description and the design of controls at a single date. A Type 2 report adds testing of how the controls operated over a period, most often 12 months. Many buyers accept a Type 1 to start, then expect a Type 2.

What is a bridge letter?
A bridge letter, sometimes called a gap letter, covers the months between the end of your last SOC report period and the date a customer needs assurance. It is written by your management, states whether controls have changed since the period ended, and is not audited by the CPA firm.

Is SOC 2 a certification?
No. SOC 1 and SOC 2 are attestation reports: a CPA firm's opinion on your controls for a stated date or period. There is no certificate. If you need a certificate that buyers can verify, ISO 27001 is the certifiable standard most often compared with SOC 2.

Can SOC 1 and SOC 2 reports be shared publicly?
No. SOC 1 reports are restricted to the service organization, its customers and their auditors. SOC 2 reports are restricted to parties who understand the system, such as customers and prospects, usually under a nondisclosure agreement. A SOC 3 report is the version designed for public use.