Glossary · SOC and attestation
A Type 1 report proves the design existed on one day.
A SOC report where the CPA firm opines, as of one date, on whether the system is described fairly and the controls were well designed and in place.
Back to the glossary01 · In plain words
In plain words
A SOC report where the CPA firm opines, as of one date, on whether the system is described fairly and the controls were well designed and in place.
A Type 1 report freezes one moment. The examiner checks that your controls are designed well enough to meet the criteria and that they exist on the stated date. It does not test whether they kept working afterwards.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
A Type 1 is often the first report a young service provider can offer, because it needs no observation period. It tells a buyer the controls are thought through and in place, which can unblock an early deal. Many enterprise buyers, though, see it only as a first step and expect a Type 2 to follow, since a design on paper says nothing about whether staff actually ran the controls month after month.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The report's title page
- States "as of" a specific date rather than "for the period".
- The service auditor's opinion
- Covers fair description and suitable design, with no opinion on operating effectiveness.
- A sales conversation
- Offered alongside a plan and target period for the first Type 2.
- A procurement checklist
- Some buyers accept it for a first year only.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a developer-tools company's first report
A Hyderabad company selling a code-scanning tool has its controls in place by 30 June and asks a CPA firm for a SOC 2 Type 1 as of that date. The report shows that change approvals, access reviews and logging are designed and present. Its first enterprise customer accepts it for the contract, with a clause asking for a Type 2 once a full period has run. The company starts keeping evidence from 1 July so that period can begin straight away.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Type 2 report
- Adds testing of how controls operated across a period. A Type 1 has no period and no operating tests.
- Readiness assessment
- An adviser's private view of your gaps. A Type 1 is a CPA firm's formal opinion that others may rely on.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Pick an as-of date when every control is genuinely running, not planned.
- Begin collecting operating evidence from the day after that date.
- Tell buyers plainly what a Type 1 covers and when a Type 2 is expected.
- GuideSOC 2 Type 1 vs Type 2Snapshot or period, the observation window, and moving between them.
- GuideFrom a Type 1 report to a Type 2What carries over, what is tested again, and what to start logging.
Sources: AICPA AT-C sections 205 and 320; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization.
Questions about Type 1 report
Is a Type 1 worth getting at all?
Often, as a first step.
It gives buyers a formal view of your design while a Type 2 period runs. Whether it is worth it depends on whether your buyers will accept it in the meantime; ask them first.
Does a Type 1 contain test results?
Not of operating effectiveness.
The examiner confirms design and implementation at the date, but there is no section reporting tests of how controls operated over time, because there is no period.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.