SOC 1
SOC 1 Type 1 or Type 2: what a client's auditor can lean on.
Both types describe your system and judge its design. Only one tells a client's auditor whether your controls actually worked during the months its client's transactions passed through them. That difference decides which type is asked for.
Back to SOC 2 services01 · The difference
Two questions a SOC 1 can answer
Type 1 answers is it designed well? Type 2 adds did it run?
Type 1
As of a specified date
- The description is fairly presented
- Controls are suitably designed to meet the stated objectives
- No tests of operation, so no results to read
Type 2
Throughout a specified period
- The same two opinions, across the period
- Controls operated effectively throughout it
- The tests performed and their results, exceptions included
Both are examinations under AT-C section 320, signed by a licensed CPA firm.
02 · Why Type 2
Why reliance needs a period
An auditor that wants to test less at its client needs evidence that covers its client's year.
A user auditor can use a SOC 1 in two ways. It can use it to understand how the outsourced process works and where errors could arise, which helps it plan. Or it can rely on your controls, meaning it does less detailed testing of the client's balances because your controls are shown to have worked. The second use needs evidence about operation over time.
What a Type 1 cannot do
A Type 1 says nothing about whether controls ran in March, June or September. The user-auditor standards treat it as useful for understanding, not as evidence of operating effectiveness. An auditor planning to rely on your controls will ask for a Type 2.
For clients under Sarbanes-Oxley section 404, the pull toward Type 2 is stronger. Management there assesses its controls over financial reporting as of each fiscal year-end, and outsourced controls are part of that picture.
03 · Fiscal-year fit
Fitting the period to your clients' years
The period that suits one client leaves a gap for another.
| Your Type 2 period | Client year-end | What the client's auditor sees |
|---|---|---|
| 1 Oct to 30 Sep | 31 December | Nine months of the year covered; three months after the period need other comfort |
| 1 Jul to 30 Jun | 31 December | Half the year covered; the auditor may also look for the prior report |
| 1 Jan to 31 Dec | 31 December | Full overlap, but the report arrives after the year-end, which can be late for the audit timetable |
| 1 Apr to 31 Mar | 31 March | Full overlap for clients on an April to March year, common in India |
Illustrative periods. With clients on several year-ends, choose the period end that leaves the smallest gap for the clients whose auditors rely on you most.
04 · Coverage gaps
Gaps, and what fills them
The months after your period ends are covered by management's word, not the CPA firm's.
When a client's year runs past your period, its auditor wants to know whether anything changed in the remaining months. The usual answer is a bridge letter signed by your management, which carries no CPA opinion. The auditor may accept it, ask questions, or do extra work at the client. Bridge letters have their own guide.
- A Type 1 has no period, so every month of the client's year is a gap.
- A first Type 2 with a short period covers little of the year; the next one should abut it, with no unexamined months in between.
- A change in system mid-period needs to be described, or the report covers less than readers assume.
05 · When Type 1 fits
When a Type 1 still makes sense
A starting point, rarely a resting place.
- A first examinationIt tests the description and design before you are judged on operation. Plan the Type 2 that follows.
- A new service or systemThere is no operating history yet to examine.
- A client that needs understanding onlySome auditors use it to plan, then test your controls another way.
- A contract deadlineWhen a client needs something formal soon, a Type 1 can show progress honestly. Say plainly that it is a Type 1.
06 · Decision table
A decision table
Choose by what the client's auditor intends to do with it.
| Situation | Usual choice | Reason |
|---|---|---|
| Auditor plans to rely on your controls | Type 2 | Only Type 2 tests operation |
| Client is under SOX section 404 | Type 2 | Management's year-end assessment covers outsourced controls |
| Brand-new service, no history | Type 1, then Type 2 | There is nothing to test over time yet |
| Auditor wants to understand the process only | Type 1 may do | Planning, not reliance |
| Renewal after a prior Type 2 | Type 2 | Keep periods continuous so no months fall outside |
Sources: AICPA SSAE No. 18, AT-C section 320 (definitions of type 1 and type 2 reports); AICPA AU-C section 402; PCAOB AS 2601; Sarbanes-Oxley Act of 2002, section 404 (15 U.S.C. 7262). Periods and situations are illustrative.
Questions about SOC 1 types
Can we skip Type 1 and go straight to Type 2?
Yes, if your controls already run and leave evidence.
Nothing requires a Type 1 first. Many providers start with a Type 2 once controls have been operating and recorded for the period they want examined.
Will a client's auditor accept a Type 1?
For understanding, often; for reliance, rarely.
A Type 1 helps an auditor see how your process is designed. If the auditor wants to reduce its own testing, it needs evidence that controls operated, which a Type 1 does not give.
Does a Type 2 have to cover twelve months?
No fixed length is set.
The standard requires a specified period, not a set length. Longer periods cover more of a client's year, and renewals commonly run to twelve months so that reports abut.
Our period ends in September and a client's year ends in March. What happens?
The client's auditor deals with six uncovered months.
It may look at your next report when it arrives, ask for a bridge letter, or test more at the client. Talk to your largest clients' teams before fixing the period end.
Pick the type your clients' auditors will use.
We look at your clients' year-ends and their auditors' plans, then prepare the controls and evidence for the type and period that fit.