Type 1 vs Type 2
One date or a whole window: choosing the SOC 2 report your buyers accept.
Both reports come out of the same kind of examination by a CPA firm. They differ in what the auditor is asked to conclude. A Type 1 answers whether controls were suitably designed and in place on one day. A Type 2 also answers whether they operated effectively throughout a defined window, so the auditor samples real evidence from across it. Below: four questions that settle the choice, an illustrative route, and the decisions that shape the window.
Back to SOC 2 services01 · What each concludes
Read the opinion and the gap is plain
Both reports share the description and the design conclusion. Only one adds a conclusion about operation over time.
- Type 1 opinion
- The system write-up is a fair picture, and the controls were designed well enough to meet the criteria as of one named date.
- Type 2 opinion
- All of the above, plus a conclusion that the controls operated effectively throughout a specified period.
- Test results
- A Type 2 lists each control, the procedure the auditor used on it and what was found. A Type 1 has no operating results to show.
Design alone tells a buyer that a sensible control exists. Operation tells them it was followed on the days nobody was watching. That is why most enterprise reviewers ask for a Type 2, and why they tend to read a Type 1 as a step on the way.
02 · Four questions
Four questions that settle it
Answer them in order. Most teams have their answer by the second or third.
- Has a buyer named the type? If a contract or questionnaire demands Type 2, a Type 1 can at best buy time. Ask the reviewer whether an interim Type 1 helps while the window runs.
- Are your controls actually operating? A Type 2 window should open only once every in-scope control runs and produces evidence. If several are still being built, a design check comes first on its own.
- Do you need something to show soon? A Type 1 does not wait for a window to elapse, so it can unblock a deal while Type 2 evidence builds up.
- Would design feedback change much? A Type 1 exposes design flaws before they turn into months of failed samples. Teams confident in their design often skip it.
A working rule
Mature controls and a patient buyer point to opening a Type 2 window directly. If either is missing, a Type 1 is a sensible first stop.
03 · An illustrative route
Illustrative: a payroll SaaS that used both
An invented company, used to show how the two reports can fit together.
Design check
A large employer wants assurance before go-live. The controls exist but have little history.
- What happens
- Fixes the system boundary and categories
- Writes the system description
- Asks the CPA firm for a Type 1 as of a chosen date
- You get
- A Type 1 report for the sales team
- A short list of design fixes
- Good practice
- Closing design flaws before evidence collection begins
- Watch for
- Opening the Type 2 window before those fixes land
First window
The Type 2 window opens once every control is running.
- What happens
- Keeps an evidence calendar for each recurring control
- Holds complete populations of tickets, changes and access events
- Runs a readiness check partway through
- You get
- Evidence the auditor can sample from any point in the window
- Good practice
- A named owner for every recurring control
- Watch for
- Recreating evidence after the event
Renewal
Later windows follow back to back.
- What happens
- Starts the next window the day after the last one closes
- Provides a bridge letter until the new report arrives
- You get
- Unbroken coverage a buyer can follow year on year
- Good practice
- Treating evidence as part of normal operations
- Watch for
- Gaps between windows that a reviewer has to query
04 · The auditor's work
What the auditor actually does in each
Procedures overlap at the start and part ways once operation is in question.
| Procedure | Type 1 | Type 2 |
|---|---|---|
| Inquiry of control owners | Yes, to understand each control | Yes, plus follow-up on anything sampled |
| Walkthrough of one instance | Yes, to confirm the control is in place | Yes, as the starting point |
| Completeness check of populations | Not needed | Yes, before any sample is drawn |
| Sampling across time | No | Yes, from the whole window |
| Re-performance of a control | Not usually | Often, for automated or calculated controls |
| Reporting deviations | Design shortfalls only | Every deviation found, as the auditor describes it |
05 · Setting the window
Decisions that shape a Type 2 window
The AICPA fixes no set length. You agree it with the CPA firm, and the controls you run decide what is workable.
- Open it when evidence flows. A window that starts before controls run will capture gaps the auditor has to report.
- Count your least frequent control. A control done quarterly or yearly needs at least one real occurrence inside the window, ideally more, for the auditor to test it.
- Fix the boundary early. Products, regions or suppliers added mid-window must be described, and the auditor may test either side of the change.
- Late controls show as late. A control introduced partway through can only be tested from its start date, and the report will record that.
- Line up the next window. Ending one window the day before the next opens avoids coverage gaps buyers notice.
Extra effort can shorten preparation. Nothing shortens the window itself, because the elapsed time is what the auditor tests.
06 · How buyers read them
How a reviewer reacts to each report
Knowing the reviewer's likely reaction lets you set expectations before anything is sent.
- Sending a Type 1 with no context. Reviewers may log it as incomplete. Add a note on when the Type 2 window opened and when its report should follow.
- A very short first window. It may be accepted, but some reviewers give it little weight, and low-frequency controls may have nothing to sample.
- An old report with no bridge letter. A window that closed long ago raises a recency question. A management bridge letter answers it.
- Assuming Type 2 means no findings. A Type 2 can list deviations alongside an unmodified opinion. Reviewers read those lines and management's responses.
Sources: AICPA attestation standards AT-C section 105 and AT-C section 205; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy; AICPA, TSP section 100, 2017 Trust Services Criteria; AICPA, DC section 200, 2018 Description Criteria.
07 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
Type questions, answered
Is a Type 1 worth anything to a buyer?
Yes, as a bridge.
It confirms that an independent CPA firm reviewed your description and control design. Many reviewers accept one for a first contract on the condition that a Type 2 follows.
Does a Type 1 involve any testing?
Of design, not of operation.
The auditor asks questions, inspects documents and usually walks through one instance of each control to confirm it is in place. It does not sample occurrences over time.
What if a control fails during the Type 2 window?
It becomes a deviation, not automatically a bad opinion.
The auditor records the deviation and judges whether, taken with your other controls, the related criterion was still met. Isolated deviations often appear beside an unmodified opinion. Our guide to opinions and exceptions explains when they do not.
After a Type 2, would we ever go back to a Type 1?
Rarely.
Once operating evidence exists, a Type 1 tells buyers less than they already have. The exception is a new system or a major rebuild, where a fresh design check can make sense before a new window opens.
Know which report you are ready for.
A SOC 2 readiness assessment tests your controls against the criteria and shows whether a design check or an evidence window should come first.