Definition
A Type 1 report includes management's description of the system and the service auditor's opinion on whether the controls are suitably designed and implemented at a specified date. A Type 2 report adds the service auditor's opinion on whether the controls operated effectively throughout a specified period and includes a description of tests and results.
Why it matters in an audit or review
A Type 1 report gives the user auditor an understanding of the service organization's controls but no evidence they worked. If the user auditor wants to reduce substantive testing based on controls at the service organization, a Type 2 report that covers a sufficient period is generally needed. The standards fix no minimum period, so the user auditor judges whether the period is long enough for the intended reliance. The auditor then reads the testing results and exceptions, and handles the gap between the report period and the user's year end.
Example
A client's year end is December 31. The provider's Type 2 report covers January 1 to September 30. The auditor reads the results, notes no exceptions, then obtains a bridge letter from the provider covering October to December and tests the client's own controls over the provider's output for the last quarter.
Common mistakes
Relying on a Type 1 report as if it tested operating effectiveness.
Sources
- AICPA, AT-C Section 320 (SSAE No. 18)
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
- AICPA, SOC 1 Guide
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error