SOC 1
SOC 1 or SOC 2: follow the question your customer is really asking.
Requests often arrive with the wrong number on them. A procurement form says SOC 2 when the client's controller needs a SOC 1, or the reverse. Work out who is asking and what they fear, and the right report usually follows.
Back to SOC 2 services01 · Question tree
Four questions, in order
Answer them for each service you sell, not for the company as a whole.
- Could an error or delay in this service change a number in a customer's financial statements? If yes, a SOC 1 is in play.
- Is the customer worried about the security, availability, confidentiality, processing integrity or privacy of what you hold or run? If yes, a SOC 2 is in play.
- Who sent the request? A controller, finance team or external auditor points to SOC 1. A security, vendor-risk or procurement team points to SOC 2.
- If both answers are yes, plan for both reports, scoped over the same system with aligned periods.
If neither answer is yes, ask the customer what problem the report is meant to solve. A questionnaire or a contract clause may meet it.
02 · Side by side
The two reports, set side by side
Same examination machinery, different yardstick and different reader.
SOC 1
Financial reporting
- Read by customers' finance teams and their auditors
- Measured against control objectives management writes
- Examined under AT-C section 320
- A failure means a misstated balance or entry
SOC 2
Trust Services Criteria
- Read by security, risk and procurement teams
- Measured against the AICPA's Trust Services Criteria
- Examined under AT-C sections 105 and 205
- A failure means a breach, outage or misuse of data
Both are restricted-use reports issued by a licensed CPA firm.
03 · What buyers ask
What buyers ask for in each path
The wording of a request tells you which path you are on.
| Path | Who asks | Typical wording | What usually satisfies |
|---|---|---|---|
| Year-end audit | Customer's external auditor, through the controller | Service auditor's report, SSAE 18, type 2, period covered | SOC 1 Type 2 plus a bridge letter |
| SOX compliance | Customer's internal audit or SOX team | Controls over outsourced processes, complementary user entity controls | SOC 1 Type 2 |
| Vendor onboarding | Procurement or vendor-risk team | Independent security assessment, SOC 2 or equivalent | SOC 2 Type 2, sometimes ISO 27001 |
| Security review | Customer's security team | Access control, encryption, incident response | SOC 2 plus a questionnaire |
Illustrative wording. Ask for the request in writing; the phrasing often settles the question.
04 · The case for both
When both reports earn their keep
Providers whose service is the customer's financial process and holds its sensitive data.
- Two audiences at one customerThe controller needs a SOC 1 for the audit; the security team needs a SOC 2 for onboarding. Neither will accept the other's report in full.
- Payroll, claims and paymentsMoney and personal data travel together, so both questions are live.
- Shared evidenceAccess reviews, change approvals and backups serve both reports, so one evidence calendar does most of the work.
- Aligned periodsRunning both over the same period keeps testing in one season and stops the two reports drifting apart.
05 · Scoping twice
Scoping the same system twice
One control, two reasons to exist.
| Control area | Why it is in the SOC 1 | Why it is in the SOC 2 |
|---|---|---|
| Logical access | Only authorised people can change pay rates or ledger data | Only authorised people can reach customer data |
| Change management | Code changes do not corrupt calculations | Changes do not open security gaps |
| Backups and recovery | Records can be restored completely and accurately | Commitments on availability are met |
| Interface checks | Files sent to banks and clients are complete | Usually supports processing integrity, if that category is chosen |
Write each control once, then tie it to the SOC 1 objective and the SOC 2 criterion it supports. The CPA firm tests against each yardstick separately, but your owners keep a single control and a single evidence trail.
06 · Mistakes
Mistakes that cost a full cycle
Each of these is found after the report is issued, which is the expensive time.
- Doing a SOC 2 for a finance request. The customer's auditor still lacks evidence about financial-reporting controls and asks again next year.
- Copying SOC 2 criteria into a SOC 1. SOC 1 objectives must speak to customers' financial reporting, not to security in general.
- One scope for both reports. A product in one report's scope may not belong in the other's. Set each boundary deliberately.
- Periods that do not line up. Separate testing seasons double the disruption for the same controls.
- Guessing instead of asking. A short call with the customer's controller often settles the question in minutes.
Sources: AICPA SSAE No. 18, AT-C sections 105, 205 and 320; AICPA SOC 1 and SOC 2 pages and the SOC suite overview; AICPA Trust Services Criteria (TSP 100). Request wording and paths are illustrative.
Questions about choosing between SOC 1 and SOC 2
Can one report be both a SOC 1 and a SOC 2?
No. They are separate reports.
Each has its own criteria, description and opinion. They can be planned together and share evidence, but the CPA firm issues two reports.
A customer asked for SOC 1 but we only have SOC 2. What now?
Ask what the customer's auditor needs.
Some auditors can use parts of a SOC 2 for specific controls, such as access. If they need assurance over calculations or transaction processing, a SOC 2 will not fill that gap.
Should we start with whichever is cheaper?
Start with the one your customers are asking for.
A report nobody asked for does not unblock a deal or an audit. Count the requests by type over the past year and start where most of them point.
Is SOC 2 the more advanced report?
No. They answer different questions.
The numbers are names, not levels. A SOC 1 answers financial auditors; a SOC 2 answers security and risk teams.
Get the right report on the first attempt.
We read your customer requests and contracts, tell you which report each one needs, and prepare one control set that serves both where it can.