It may come as a bit of a surprise—maybe not—but there are actually two types of SOC reports. Upon examination, the service organization is responsible for specifying whether or not a “Type 1” or “Type 2” will be performed. It’s important to note the specific use of “Type” as a distinguisher--not “SOC 1” or “SOC 2,” as the different specified “types” are options for both the SOC 1 and SOC 2 reports. For those of you that are now thinking, “that’s confusing,” I agree 100% with you. In fact, “Type 2” and “SOC 2” are not at all the same thing, and the “type” of each SOC examination presents important differences for service organizations.
To begin, a “Type 1” SOC examination is typically performed when management requires a report on the fairness of presentation of the service organization’s description of internal controls and the suitability of the design of controls as of a specified date —or, whether the description of the controls and overall system is accurate and not misleading.
In contrast, a “Type 2” SOC examination differs in that one is completed when management requires a report that covers a period--usually 12 months. This kind of report is a little similar to the Type 1 in that it includes an independent opinion on the fairness of presentation of the service organization’s description of internal controls and the suitability of the design; that being said, a Type 2 report also includes the operating effectiveness of controls over a specific time, which is officially referred to as the review period. Review periods typically cover a 12-month period—though first-time Type 2 reports will have a shorter period. Type 2 reports occur on an annual basis and can reduce the need to provide customers with a what is known as a gap letter.
Does a Type 1 Provide any Value?
This is a question we receive from organizations frequently, in some form or fashion, and it arises because of a conflict between the customer need for a Type 2 report and the ability to provide a favorable report or a report that adds value to the customer. Because of that conflict, there are questions posed, such as, “is a Type 1 report worthless?” Or “what does the roadmap or process look like to get to a SOC report that meets our client’s requirements?”—these are blunt, but important inquiries.
First, it is important to understand that, most of the time, there are two key drivers behind a SOC initiative:
- The immediate client requirements and
- A value-added report that demonstrates an established product or service assurance (marketing) to prospects by the sales team.
Regarding both of those drivers, there are several factors to consider, such as the organization’s industry, current client requirements and time to comply, and maturity of the product or service being offered.
Looking at the current trends, very few organizations do a Type 1 report on a recurring basis. Generally, Type 1 reports are performed the first year as a bridge, or preparedness if you will, to the Type 2 report.
Since the Type 1 is as of a specific date (or point-in-time), an organization can remediate control gaps in their environment, if necessary, prior to completion of the Type 1 reporting process. Upon completion of the Type 1, it would be imperative to ensure that the controls can operate during the following Type 2 review period.
For many organizations, a SOC report is required to meet both client requirements and/or internal goals, which is how we normally back into the debate of whether or not a Type 1 report provides value for an organization. In fact, it’s not the same answer for all organizations. For some, the answer is a resounding yes, since it enables them to meet immediate client and prospective client requirements, and demonstrates a clear compliance roadmap. In other cases, the benefits may not be as great if the examination is only being done for a single client or prospect. Personally, I would argue that even in these cases, a Type 1 report allows the organization to mature their control set while satisfying a client requirement.
Now let’s circle back to the question, “is a Type 1 report worthless?” I’ve always found this judgement to be very harsh and really lacking in understanding of the purpose of a Type 1 report versus a Type 2 report. When pitted directly against one another, the answer is more obvious--yes, the Type 2 contains the same information as a Type 1 report, while also adding the tests of operating effectiveness of the controls over a period. That addition gives the Type 2 report, without a doubt, a higher level of assurance than a Type 1 report. That being said, when looking at the two types from a different angle, the answer is a little more flexible. For example, is a company receiving a SOC report better off receiving a Type 1 six to nine months sooner than a Type 2 report? I’m guessing you see where I’m going with this. In those cases, a Type 1 report is acceptable and beneficial in the first year, rather than waiting for completion of a Type 2.
In the end, each organization will have its own challenges, internal and external requirements and goals but having options is a good thing. In many cases, the right answer will be determined based on the tradeoff of timeliness versus comprehensiveness, but the bottom line remains that both types of SOC reports have merit and a unique purpose in compliance.