Running the engagement
From a Type 1 report to a Type 2.
A Type 1 says your controls were suitably designed on one date. A Type 2 adds whether they operated effectively across a period. The move is not a repeat of the first audit. Most of the paperwork carries over; what's new is proof over time, and that proof starts the day your period starts.
Back to SOC 2 services01 · The difference
Design at a date, then operation over time
Same criteria, same description shape. A different question.
Type 1
Is it designed well?
- Opinion as of a single date
- Description fairly presented
- Controls suitably designed and implemented
- No testing of how controls ran over time
Type 2
Did it work all along?
- Opinion for a period
- Everything in Type 1, across the period
- Controls operated effectively throughout
- Section 4 lists the tests and their results
A Type 1 is useful evidence of intent. Many buyers' security teams will still ask when the Type 2 is due.
02 · What carries over
What you keep, and what is tested again
The documents carry over. The evidence does not.
- System description
- Carries over, updated for anything that changed since the Type 1 date and extended with the period's significant changes.
- Control wording
- Carries over, unless the Type 1 surfaced wording that over-promises. Fix that before the period starts, not during it.
- Design
- Carries over as a starting point. The auditor still re-evaluates design for the Type 2, because the system may have moved on.
- Evidence of operation
- Starts fresh. The single samples that proved implementation at the Type 1 date don't count toward the period.
Expect the CPA firm to re-test design and implementation as part of the Type 2, then test operation across the period with samples drawn from full populations. If you use the same firm, their understanding of your system shortens the learning curve; it doesn't let them skip steps.
03 · The day after
What to start logging the day after your Type 1
Every recurring control needs a dated trail from the first day of the period.
- Joiners and leavers. Every grant and removal, with the approval and the date, so the population is complete.
- Changes to production. Every merge or deploy with its review, including emergency fixes.
- Scheduled reviews. Access, firewall rules, vendor reviews, logs, each with the reviewer's name and date.
- Alerts and incidents. What fired, who looked, and what happened next.
- Annual items. Risk assessment, policy approval, security training, background checks for new hires, placed inside the period so they can be tested.
The Type 1 date is a natural start line. Starting the Type 2 period soon after it keeps the design the auditor just reviewed fresh and avoids a long untested stretch.
04 · Common gaps
Gaps that tend to appear at the move
Things that looked fine on one date and wobble over months.
- Quarterly controls that run once. The access review happened before the Type 1 and then drifted.
- Annual controls outside the period. The risk assessment was done just before the period began, so there is nothing to test inside it.
- Evidence in someone's inbox. Approvals given in chat or email, scattered and hard to compile into a population.
- Short log retention. A tool keeps audit logs for less than the period, so early months vanish.
- Exceptions treated as one-offs. A missed leaver is fixed but the process that missed them isn't.
05 · Skipping Type 1
Should you skip Type 1 altogether?
Sometimes. It depends on who is waiting and how settled your controls are.
| Your situation (illustrative) | A sensible path | Why |
|---|---|---|
| A buyer needs something from an auditor soon, controls are new | Type 1 first | Gives an independent design opinion while the Type 2 period runs |
| Controls have run reliably for months with good records | Straight to Type 2 | A Type 1 would add a report buyers may treat as a stepping stone |
| Buyers' contracts name a Type 2 explicitly | Straight to Type 2, with a readiness assessment first | A Type 1 won't satisfy the requirement on its own |
| Large design changes still planned | Hold both until design settles | Neither report should describe a system you're about to rebuild |
| Unsure whether the design will hold up | Readiness assessment, then decide | Finds design gaps without producing a report anyone relies on |
Sources: AICPA AT-C section 205; AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization (type 1 and type 2 engagements); AICPA DC section 200.
Questions about the move to Type 2
Does the Type 2 period have to start on the day after the Type 1 date?
No, but a gap between them is untested time.
You choose the period with your CPA firm. Starting close to the Type 1 date means buyers see continuous attention. A long gap isn't forbidden; it just isn't covered by either report.
Can we change controls between the Type 1 and the Type 2?
Yes, and before the period is the best time.
Changes made before the period starts simply become the design the Type 2 tests. Changes during the period are tested in slices and described as significant changes if they matter to readers.
Will the Type 2 report mention our Type 1?
Usually not in any detail.
Each report stands on its own, with its own opinion and period. Buyers will mostly read the newest one. Keep the Type 1 for questionnaires that ask for your history.
If our Type 1 had no issues, will the Type 2 be clean?
Not necessarily.
A clean Type 1 says the design was right on one date. A Type 2 tests whether people kept doing it. Most Type 2 exceptions come from consistency, not design.
Turn a good design into a clean period.
We set up an evidence calendar right after your Type 1 so every control starts leaving a trail on day one.