SOC 1, SOC 2 and SOC 3 reports, and Type 1 versus Type 2

In this lesson you will

Distinguish SOC 1, SOC 2 and SOC 3 reports by subject matter and users
Explain the difference between a Type 1 and a Type 2 report
Select the report that supports reliance on service organization controls
Recognize when a SOC 2 report has limited use in a financial statement audit

The SOC family

The AICPA's System and Organization Controls (SOC) suite covers engagements in which a CPA examines and reports on controls at a service organization. The subject matter differs by report.

Report	Subject matter	Primary users
SOC 1	Controls at a service organization relevant to user entities' internal control over financial reporting	User entities' management and their auditors
SOC 2	Controls relevant to security, availability, processing integrity, confidentiality or privacy, evaluated against the trust services criteria	Customers, regulators and others with sufficient knowledge of the system
SOC 3	Same trust services categories as SOC 2, with less detail	General public; a general use report

The AICPA describes SOC 3 reports as covering the same areas as SOC 2 but without the same level of detail, so they are general use reports that can be freely distributed. SOC 1 and SOC 2 reports contain detailed descriptions of controls and test results and are restricted to specified users.

SOC 1 engagements are performed under AT-C 320, the attestation standard for examinations of controls at a service organization relevant to user entities' ICFR. SOC 2 engagements are examinations under AT-C 205 that use the AICPA's 2017 Trust Services Criteria (with revised points of focus, 2022) as the criteria for the controls. SOC 3 reports use the same criteria.

Type 1 and Type 2

AU-C 402 defines both:

A type 1 report covers management's description of the service organization's system and the suitability of the design of controls to achieve the stated control objectives as of a specified date.
A type 2 report covers the description, the suitability of design, and whether the controls operated effectively throughout a specified period, and includes the service auditor's description of tests of controls and results.

AS 2601 uses older terms: a report on controls placed in operation (type 1) and a report on controls placed in operation and tests of operating effectiveness (type 2). AS 2601.12 states that a report on controls placed in operation is not intended to provide evidence of operating effectiveness that would allow the user auditor to reduce control risk below the maximum.

Which report the financial statement auditor needs

If you plan to rely on controls at the service organization (for example, payroll calculation controls at a payroll provider), you need evidence of operating effectiveness. Under AU-C 402, that comes from a type 2 report, tests of controls at the service organization, or another auditor performing tests on your behalf. A type 1 report helps you understand the system but does not support reliance.

If you do not plan to rely on those controls, a type 1 report or other information may be enough for understanding, and you respond with substantive procedures.

Using a SOC 2 report in a financial statement audit

Clients often hand the auditor a SOC 2 report because that is what the vendor has. A SOC 2 report addresses security and other trust services categories, not control objectives tied to financial reporting. It can provide useful evidence about access and change controls at a hosting provider, but it may not cover the processing controls (calculations, completeness of transactions) that matter to your assertions. Read the description and the controls tested, and map them to your risks before deciding.

Reading a SOC 1 report

A SOC 1 report usually has:

The service auditor's opinion.
Management's assertion.
The description of the system, including control objectives, complementary user entity controls and any subservice organizations.
The service auditor's tests of controls and results (type 2 only).
Other information not covered by the opinion.

Lessons 11 to 13 cover how the user auditor evaluates each part.

Worked example

Choosing the right report for Bayberry Health Partners

Bayberry Health Partners outsources three functions:

Payroll processing to a payroll provider. The provider offers a SOC 1 type 2 report covering January 1 to September 30.
Hosting of its general ledger system with a cloud provider. The provider offers a SOC 2 type 2 report on security and availability.
Claims billing to a billing company. The billing company offers only a SOC 1 type 1 report as of June 30.

The audit plan relies on controls for payroll and plans to rely on automated controls in the general ledger.

Payroll: the SOC 1 type 2 report supports reliance on payroll calculation controls for the period it covers. The gap from October 1 to December 31 is addressed in lesson 13.

Hosting: the SOC 2 report covers logical access, change management of the infrastructure and backups. The team maps these to its ITGC risks for the hosted ledger and concludes the report provides evidence for infrastructure access and operations. It does not cover the ledger's application configuration, which Bayberry manages itself, so the team tests that directly.

Billing: the type 1 report gives an understanding of design only. The team does not rely on the billing company's controls and performs substantive procedures over billed revenue, including tracing a sample of claims to remittances.

Conclusion: three outsourced functions, three different responses driven by the report type and subject matter.

Self-check

Answer each question before you open the answer.

Which SOC report is a general use report?
Show answer
SOC 3. The AICPA describes it as covering the same trust services areas as SOC 2 with less detail, so it can be freely distributed.
Can a type 1 report support a control risk assessment below the maximum?
Show answer
No. It covers design as of a date. AS 2601.12 states a report on controls placed in operation does not provide evidence of operating effectiveness, and AU-C 402 points to a type 2 report or tests of controls for that evidence.
A client gives you a SOC 2 report for its payroll provider. What do you check before using it?
Show answer
Whether the controls described and tested address your financial reporting risks, such as completeness and accuracy of payroll calculations. SOC 2 is built on the trust services criteria, so processing controls relevant to ICFR may not be covered.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error