Glossary · SOC and attestation
Type 2 asks the harder question: did the controls keep working?
A SOC report in which the CPA firm tests and gives an opinion on whether controls operated effectively throughout a stated period, in addition to their design.
Back to the glossary01 · In plain words
In plain words
A SOC report in which the CPA firm tests and gives an opinion on whether controls operated effectively throughout a stated period, in addition to their design.
A Type 2 report covers a stretch of time, not a single day. The examiner samples evidence across that period to see whether each control actually ran as described. The results, including any misses, are listed control by control.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Most enterprise buyers and their auditors want a Type 2, because it shows behaviour, not intent. It lets a reader see, for instance, that terminated staff lost access promptly in the sampled cases across the year. The report also lists deviations, so a reader can judge whether a miss matters to them. For the service provider, it means evidence must be kept continuously, since the examiner can sample any point in the period.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The report's title page
- States "for the period" with a start and end date.
- Section 4 of the report
- Each control, the examiner's test, and the result, including exceptions.
- A customer's annual vendor review
- Checked for period coverage and any deviations relevant to them.
- A bridge letter
- Issued by management to cover the gap between the period's end and today.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: one deviation in a reconciliation firm's report
A Mumbai payments-reconciliation provider receives a SOC 1 Type 2 for a nine-month period. In 25 sampled leavers, one account was disabled eleven days late. The report lists this as a deviation, and management's response explains the cause and the fix. A bank client's auditor reads it, checks that the late account had no activity, and concludes it does not change their reliance on the report.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Type 1 report
- Covers design at one date only. A Type 2 also tests operation across a period.
- Observation period
- The window a Type 2 covers. The report is the result; the period is the time it describes.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Choose a period length your buyers accept; periods of three to twelve months are commonly used, with later reports usually covering twelve.
- Keep evidence as controls run, with dates, owners and sources.
- Prepare a written response for any deviation the examiner finds.
- Plan back-to-back periods so coverage has no gaps.
- GuideSOC 2 Type 1 vs Type 2Snapshot or period, the observation window, and moving between them.
- GuideChoosing the length of the observation periodThe trade-offs between a short and a long Type 2 window.
- GuideSOC 1 Type 1 vs Type 2Design at a date or operation over a period, and what auditors want.
Sources: AICPA AT-C sections 205 and 320; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization; AICPA Guide, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1).
Questions about Type 2 report
Does one deviation mean the report failed?
Not necessarily.
A deviation is listed with the test result. Whether it changes the opinion depends on how serious and widespread it is. Many reports contain a few deviations and still carry an unmodified opinion.
Can the first SOC report be a Type 2?
Yes.
There is no rule that a Type 1 must come first. A company with controls already running can start an observation period and go straight to a Type 2.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.