SOC 2 Type 1 vs Type 2: which report your customers want, and when to get each

Type 1 and Type 2 in two paragraphs

A Type 1 report speaks to one date. The CPA firm performing the examination gives its opinion on whether management's description of the system is presented in accordance with the AICPA description criteria, and whether the controls described are suitably designed to provide reasonable assurance that your service commitments and system requirements would be achieved under the Trust Services Criteria in scope. It confirms the controls were in place on that date, not that they worked before or after it.

A Type 2 covers the same description and design across a period agreed with the CPA firm, commonly three to twelve months, and adds a third opinion: whether the controls operated effectively throughout it. The report sets out every test performed and its result. A Type 1 tells a customer the controls are well designed; a Type 2 tells them the controls have worked.

Who asks for which report, and why

The request comes from outside: a security questionnaire, a procurement checklist, a contract clause or an annual vendor review. The AICPA's description of its SOC 2 guide likewise names customers and business partners as the ones who ask.

• Enterprise procurement and vendor-risk teams generally require a Type 2, because they are judging whether a supplier's controls will hold for the life of a contract.
• A first contract with a new vendor is where a Type 1 is most often accepted, with a written commitment to a Type 2 by an agreed date.
• Existing customers ask for the latest Type 2 each year, plus a bridge letter if its period ended months earlier.

Ask before you plan: contracts and vendor-risk policies often specify the type, the categories and how recent the period must be.

The sequence most organisations follow

1. Gap analysis and readiness assessment

A gap analysis defines the system and categories, maps existing controls to the criteria and designs what is missing. A readiness assessment then tests the controls as the CPA firm will, while flaws can still be fixed outside a report.

2. A Type 1 first, or straight to Type 2

With a deadline a Type 2 cannot meet, many organisations take a Type 1 first, ideally dated on the first day of the Type 2 period so that no months are lost. Without that pressure, going straight to a Type 2 with a shorter first period saves a report that customers would soon treat as dated.

3. The observation period

From the first day of the period, every control must run as described and leave a record. CPA firms often test some controls while the period runs.

4. Annual Type 2 reports and bridge letters

Renewals normally use twelve-month periods that run back to back, so every day falls within a report. While the next report is prepared, customers receive a bridge letter, or gap letter: a statement signed by your management, not the CPA firm, that nothing material has changed in the system or controls since the period ended, or describing what has. It carries no assurance, so customers accept it only for short intervals.

What changes in evidence collection

For a Type 1, the CPA firm needs to see that each control exists and is properly designed: policies, procedures, configurations, responsibilities and a walkthrough of one instance.

A Type 2 asks whether each control ran every time it should have. The firm requests complete populations for the period, such as every change deployed, every leaver and every incident, checks their completeness and samples from them. The less often a control runs, the larger the share of its occurrences inspected.

Take a quarterly access review. For a Type 1, the firm reads the procedure and inspects one completed review. For a twelve-month Type 2, it inspects reviews from across the year, checks that each covered a complete user list, and follows flagged accounts to their removal. A review missed in the second quarter cannot be repaired in the third: it is an exception.

Exceptions and their handling

An exception, or deviation, is an occurrence where a control did not operate as described, such as a leaver's access removed late or a change deployed without approval. The firm may extend its testing and consider whether other controls limited the effect; you establish the cause, correct it and write management's response. A mid-period correction protects the next period, not the occurrences that failed before it.

How the opinion and the exceptions read

Both types contain the CPA firm's report and opinion, management's assertion and the system description. A Type 2 adds the tests of controls and their results, where exceptions are listed; management's responses usually sit in a separate section that the opinion does not cover.

An unmodified, or clean, opinion can sit above a list of exceptions: the firm has concluded that the controls, taken together, still gave reasonable assurance that the commitments and requirements were achieved. A qualified opinion names a matter where, in the firm's judgement, a criterion was not met or the description was materially misstated. Careful readers also check the period dates, the categories in scope, any subservice organisation carved out, typically the cloud provider, and the complementary user entity controls the customer is expected to operate itself.

Type 1 and Type 2 side by side

Cost and timing, in relative terms

A Type 2 costs more than a Type 1 of the same scope, and your internal effort grows more than the fee, because evidence is produced throughout the period. A Type 1 first adds a second engagement, worthwhile when it secures the contract. The period, not the documentation, fixes the date of your first Type 2, so plan backwards from the customer's deadline.

Three mistakes that cost a reporting cycle

• Opening a Type 2 period before the controls have operated. A period that starts the day the policies are approved begins with reviews never held and changes never approved, each a potential exception. Open it once the readiness assessment shows every control producing records.
• Treating the Type 1 as the destination. Within a year customers ask for proof of operation, and with no period under way the wait is long.
• Leaving gaps between periods. Months between the end of one period and the start of the next are covered by no report, and a bridge letter is not meant to stretch that far. Start each period the day after the last one ends.

SOC 2 Type 1 vs Type 2: questions buyers ask