SOC 1 reports cover a service provider's controls that affect your financial reporting. SOC 2 reports cover its controls over security and related areas, tested against the Trust Services Criteria. SOC 3 is a short public summary of a SOC 2 result. Type 1 or Type 2 is a separate choice that applies to SOC 1 and SOC 2.
Last reviewed: 17 October 2026. Facts checked. We searched for how SOC 1, SOC 2 and SOC 3 differ and for the Type 1 and Type 2 split. The results were secondary sources (compliance vendors and audit firms). We did not open the AICPA standards or guides themselves, so we do not quote standard numbers or paragraph references. Check the AICPA's own guidance before citing a standard in a report.
What "SOC" means
SOC stands for System and Organization Controls. A SOC report is written by an independent auditor (usually a CPA firm) about the controls at a service organisation. A service organisation is a business that handles something for its customers, such as hosting data, running payroll or processing payments.
The reports follow attestation standards issued by the AICPA, the American Institute of CPAs. SOC 1 is commonly described as built on SSAE 18, the attestation standard. Attestation means the auditor gives a conclusion on a statement made by management. It is not the same as an audit of financial statements.
The three reports side by side
| SOC 1 | SOC 2 | SOC 3 | |
|---|---|---|---|
| Subject | Controls relevant to the customer's financial reporting | Controls against the Trust Services Criteria | Same subject as SOC 2, in summary |
| Typical reader | Customer's finance team and their auditors | Customer's security, risk and procurement teams | Anyone, including website visitors |
| Distribution | Restricted to specific parties | Restricted to specific parties | Can be public |
| Detail of tests | Described | Described | Not included |
Sources describe SOC 3 as issued only after a SOC 2 Type 2 result, not on its own. It is a seal and a short opinion, without the test detail.
Type 1 versus Type 2
- Type 1 looks at whether controls are designed and in place at one date.
- Type 2 tests whether controls operated effectively over a period of time.
A Type 1 report is a snapshot. A Type 2 report is closer to a film. For a customer relying on the provider day after day, Type 2 usually gives more comfort, because it shows controls working over time rather than only on paper.
Which report should you ask for?
| Your question | Ask for |
|---|---|
| Does this provider's work feed into our financial statements? For example payroll, billing or a hosted ledger. | SOC 1 |
| Is our data safe with this provider? | SOC 2 |
| We only need a quick public assurance for a first screening | SOC 3, then ask for SOC 2 |
| The provider says "we are certified" | Ask which report, which type, and which period |
A SOC 2 does not replace a SOC 1, and the reverse is also true. They answer different questions. A payroll vendor may need both.
How to read a SOC report: a short checklist
- Check the period. For a Type 2, does it cover the period you care about? Is there a gap between the end of the period and today? A bridge letter is sometimes used to cover the gap. Treat it as management's statement, not auditor assurance.
- Read the opinion. Is it unmodified or qualified? A qualification points to a control that failed or a scope problem.
- Read the exceptions. Look at the test results section. Exceptions found in testing matter more than the headline.
- Check the system description. Does the scope include the service you actually use, and the locations or systems that matter?
- Check subservice organisations. Providers often rely on other providers, for example a cloud host. The report may exclude their controls (the "carve-out" method). Then you need their reports too.
- Check the complementary user entity controls. These are controls the provider expects you to run, such as removing leavers' access promptly. If you do not run them, the provider's controls may not protect you.
Common mistakes
- Treating SOC 3 as equal to SOC 2. It has no test detail.
- Filing the report without reading the exceptions.
- Forgetting the user controls the report expects from you.
- Assuming a report covers every product the provider sells.
For where these reports fit in IT auditing, see our guides on IT general controls and on SOX ITGC testing. If a provider's controls are central to your financial reporting, the difference between IT audit, ITGC and cybersecurity audit helps you choose what to review yourself.
Frequently Asked Questions
Is a SOC report a certification?
No. It is an auditor's report on controls, with an opinion and a description of tests. It is not a pass mark. Read the opinion and the exceptions.
Can an Indian company use SOC reports?
Yes. Many Indian service providers, including outsourcing and software firms, obtain SOC reports because their overseas customers ask for them. An Indian customer can also ask its vendors for one. The reports are issued by independent auditors working under AICPA standards.
Do I need SOC 1 or SOC 2 for a cloud vendor?
It depends on the question. If the vendor affects your financial reporting, ask for SOC 1. If you are worried about the security of your data, ask for SOC 2. Many customers ask for both.
Is Type 2 always better than Type 1?
For relying on a provider over time, Type 2 gives more evidence. A Type 1 can still be useful for a new provider that has not yet had time to build a testing period.
Who can issue a SOC report?
An independent auditor, typically a CPA firm, working under AICPA attestation standards. The provider cannot issue it for itself.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error