SOC 2 Type 1 vs Type 2: What Each Report Covers and How to Read Them

A SOC 2 report is an independent CPA's report on a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy. It comes in two types. A Type 1 report speaks to the design of controls at a single date. A Type 2 report adds testing of whether those controls operated effectively over a period.

Everything else follows from that difference: what the report proves, who will accept it, and how long it takes. This guide explains both types, what is in the report, how to read exceptions, and how the two fit a client's vendor-management and audit needs. It treats SOC 2 as a professional standard. There is no "SOC 2 certification"; the output is an examination report with a CPA's opinion.

The standards behind a SOC 2 report

A SOC 2 engagement is an examination performed by a CPA firm under the AICPA's attestation standards (AT-C section 105 for concepts common to attest engagements and AT-C section 205 for examination engagements). The criteria come from two AICPA documents:

• the Trust Services Criteria (TSP section 100), organized in five categories: security, availability, processing integrity, confidentiality and privacy; and
• the description criteria (DC section 200), which set what management's description of the system should contain.

Security is the base category; its common criteria apply to every SOC 2 engagement. Management chooses which of the other four categories to include. The AICPA has also issued exposure drafts of proposed revisions to the criteria, so the edition in effect for the engagement period governs.

Type 1 vs Type 2

The standards do not fix a minimum period for a Type 2 report. The service organization and its service auditor set the period, and user organizations decide whether it is long enough for their purposes. A period of several months to a year is common in practice, and many service organizations issue a Type 1 first and move to a Type 2 for the next cycle.

What is in a SOC 2 report

1. Service auditor's report. The opinion, scope and the basis for it, including any modification.
2. Management's assertion. Management states that the description is fair and that controls were designed (and, for Type 2, operated) effectively.
3. System description. The infrastructure, software, people, procedures and data in scope, the commitments to customers and the principal service commitments and system requirements.
4. Trust Services Criteria and controls. The controls management says meet each criterion.
5. Tests and results (Type 2 only). The tests the service auditor performed and the results, including exceptions.

The description also names subservice organizations and whether they are carved out or included, and lists the complementary user entity controls the customer is expected to have in place. See subservice organization and complementary user entity controls.

How to read a report

Start with the opinion

An unmodified opinion means the examination did not find material issues in the matters opined on, and does not mean the controls had no exceptions. A qualified or adverse opinion, or a disclaimer, is the first thing to escalate.

Check the period and the carve-outs

For Type 2, check whether the period covers the customer's period of interest, which services and locations are in scope, which categories are included, and whether key subservice organizations are carved out. A report that excludes the hosting provider says nothing about that provider.

Read the exceptions

The tests-and-results section is where the value is. For each exception, read the management response and ask whether the control objective was still met. Two points to separate: a control that did not operate in a few instances, versus a control that was missing or ineffective for the whole period.

Map complementary user entity controls

Every SOC 2 report assumes controls on the customer side. If the report says the customer is responsible for removing departing users' access, the customer needs a matching control.

Bridging the gap to year end

A Type 2 period rarely ends on the customer's year end. Illustrative example: a customer has a December 31 year end and relies on a vendor whose Type 2 covers October 1, 2025 to September 30, 2026. The gap from October 1 to December 31 is 31 + 30 + 31 = 92 days. The customer obtains a bridge letter from the vendor stating whether anything has changed in controls during the gap. A bridge letter is management's statement, not an opinion by the service auditor. See bridge letter.

SOC 2 vs SOC 1

SOC 1 reports address controls at a service organization relevant to its customers' internal control over financial reporting, and a user auditor uses them under AU-C 402. SOC 2 reports address the Trust Services Criteria. They do not directly address controls over financial reporting, so a SOC 2 is not a substitute for a SOC 1 when a financial statement auditor needs evidence about a service organization that processes transactions. See service organizations: SOC 1 reports and AU-C 402 and SOC 1 report.

Which report fits which need

• Type 1 fits a service organization that has just built its control environment and needs to show customers a design-stage report, or a customer doing preliminary vendor diligence.
• Type 2 fits ongoing vendor assurance, security questionnaires that ask for operating effectiveness and any case where a user relies on the controls working.
• Neither replaces the customer's own monitoring. Reviewing the report, mapping complementary user entity controls and following up on exceptions are the customer's job.

SOC 2 reports are generally intended for the specified parties who have sufficient understanding of the system, not for general distribution. A general-use report on the same subject matter is a SOC 3.

Common mistakes

• Calling a Type 1 "a SOC 2 audit passed" in vendor files when it covers design only.
• Accepting a report that does not cover the relevant period or services.
• Ignoring carve-out subservice organizations and the complementary user entity controls.
• Reading the opinion and skipping the exceptions.
• Treating the report as pass or fail. It is an opinion with detail, not a score.

FAQ

Is SOC 2 Type 2 better than Type 1?

It gives more assurance because it tests operating effectiveness. Type 1 is a smaller scope and is the usual first step. Which one a customer needs depends on whether it relies on controls operating over time.

How long does a SOC 2 Type 2 cover?

The standards set no minimum. The service organization and service auditor choose the period, and customers decide whether it is long enough for their use.

Is SOC 2 a certification?

No. It is an examination under AICPA attestation standards that results in a CPA's report with an opinion. Vendors sometimes say they are "SOC 2 certified", but there is no certificate.

What is the difference between SOC 1 and SOC 2?

SOC 1 addresses controls relevant to customers' financial reporting. SOC 2 addresses security, availability, processing integrity, confidentiality and privacy.

What is a bridge letter?

It is a letter from the service organization's management covering the period between the end of a Type 2 report and the customer's year end, stating whether controls changed.

Sources

• AICPA, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy: AICPA-CIMA
• AICPA, 2018 SOC 2 Description Criteria (DC section 200, with revised implementation guidance)
• AICPA, Illustrative SOC 2 report with illustrative system description
• AICPA, Trust Services Criteria (TSP section 100); AT-C sections 105 and 205
• AICPA, Exposure drafts of proposed 2027 SOC 2 criteria
• AICPA, AU-C section 402, Audit Considerations Relating to an Entity Using a Service Organization

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error