SOC 1 vs SOC 2 vs SOC 3: Which Report, Who Uses It and When

System and Organization Controls, or SOC, is the AICPA's suite of reports on controls at a service organization or, in some versions, at any entity. The three reports with the numbers 1, 2 and 3 look alike and are often confused, especially by procurement teams who ask for "a SOC report" without saying which. They answer different questions for different readers.

This guide compares them side by side and gives a rule for which one to request. For the auditor's side of using a report in a financial statement audit, see the SOC 1 and AU-C 402 guide. For Type 1 and Type 2 see SOC 2 Type 1 vs Type 2.

What are SOC reports?

A SOC report is an assurance report from an independent CPA firm, the service auditor, on controls at a service organization. A service organization is a third party that provides services to other entities, called user entities, such as payroll processing, claims administration, hosting or custody. The reports are issued under the AICPA's attestation standards. The AICPA describes the SOC suite as services CPAs may provide to help users assess outsourcing risks, and it includes SOC for Cybersecurity and SOC for Supply Chain alongside SOC 1, SOC 2 and SOC 3.

SOC 1, SOC 2 and SOC 3 compared

Security is the base category in a SOC 2 and applies to every SOC 2 engagement; management chooses which of the other four categories to add.

Two clarifications on the table:

• Restricted use means the report is intended for specified parties, such as current user entities and their auditors. A SOC 1 or SOC 2 report is normally not published.
• General use means the report can be shared publicly. Because it does not include the detailed description of controls and test results, a SOC 3 gives a reader much less information than a SOC 2 on the same engagement.

What each report is for

SOC 1 is the report a user auditor relies on. If a provider processes transactions that flow into a client's financial statements, such as payroll, loan servicing or claims, the controls at the provider are part of the client's internal control relevant to the audit. A SOC 1 Type 2 gives evidence of how those controls operated.

SOC 2 answers security and operational due diligence questions from customers. It helps a financial statement auditor understand IT risks at a hosting vendor, but it is not evidence of controls over financial reporting.

SOC 3 is a marketing-friendly summary for a general audience. It states whether the system met the criteria, with no confidential detail. It is not a substitute for a SOC 2 in a vendor review.

How to choose which report to request

If a service organization offers a SOC 2 and the audit needs a SOC 1, say so directly. A SOC 2 does not cover transaction processing accuracy, authorization or completeness, which are the matters a financial statement auditor cares about. See SOC 2 report and SOC 1 report.

What to check in any SOC report

• Scope. Does it cover the services and systems you use, and the right locations?
• Period. For a Type 2 report, does the period cover most of your fiscal year? How will you address the gap to year end? See bridge letter.
• Opinion. Is it unmodified? A qualification may sit on the control you intended to rely on.
• Exceptions. Read each deviation and management's response.
• Subservice organizations. Are they included or carved out? See subservice organization.
• Complementary user entity controls. Which controls must you operate for the report's conclusions to hold? See complementary user entity controls.

The service organization report review checklist and the SOC 1 readiness checklist support this review.

Worked example (illustrative)

An auditor is planning the audit of a manufacturer that outsources payroll and hosts its ERP at a cloud provider.

• Payroll provider. Payroll is about 38% of operating expenses in this illustration, and the manufacturer's own review is limited to totals. The auditor requests the provider's SOC 1 Type 2 for the period January 1 to September 30. It is unmodified, with one exception in a control over tax rate table updates that the provider resolved in July. The auditor notes the gap from October 1 to December 31, obtains a bridge letter, and adds substantive tests of payroll tax calculations for the last quarter.
• Cloud ERP host. The provider sends a SOC 2 Type 2 covering security and availability. The auditor reads it to understand logical access and backup controls and to identify the complementary user entity controls the manufacturer must operate, such as user provisioning. The auditor does not treat it as evidence on processing integrity of the ERP's calculations and instead tests relevant controls and system outputs directly.
• SOC 3. The ERP vendor's website shows a SOC 3. The auditor does not use it, because it contains no description of controls or test results.

Mistakes to avoid

• Accepting a SOC 2 in place of a SOC 1 for a service that affects financial reporting.
• Treating a Type 1 report as evidence that controls operated.
• Ignoring the period covered and the gap to year end.
• Not mapping complementary user entity controls to the client's own procedures.
• Treating the SOC 3 as the full report.

Frequently asked questions

What is the main difference between SOC 1 and SOC 2?

SOC 1 covers controls relevant to user entities' internal control over financial reporting. SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality or privacy. SOC 1 is the one financial statement auditors rely on.

Is a SOC 3 report the same as a SOC 2?

No. Both report on the trust services criteria, but a SOC 3 is a general-use report without the detailed system description, controls and test results that a SOC 2 contains.

Which SOC report do auditors use?

For the audit of a user entity, the SOC 1 Type 2 report, under AU-C 402. A SOC 2 can help with IT understanding but does not address controls over financial reporting.

Are SOC reports certifications?

No. They are attestation reports issued by CPA firms. They describe controls and the service auditor's opinion, and do not certify compliance with a regulation.

Sources

• AICPA and CIMA, System and Organization Controls (SOC) Suite of Services: https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services
• AICPA, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with Revised Points of Focus, 2022): https://www.aicpa-cima.com/resources/article/2017-trust-services-criteria-with-revised-points-of-focus-2022
• AICPA, AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting
• AICPA, AT-C Sections 105 and 205
• AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error