Type 1 vs. Type 2 in SOC Reports

If you’ve decided to try for compliance, you might already know that, given how much this space has evolved in just the last 20 years, there are a lot of ways to do that.

Just making the decision to be evaluated against SOC is one thing, drilling down to whether you need a SOC 1, SOC 2, SOC 3, SOC for Supply Chain, or SOC for Cybersecurity report is a more complicated rodeo.

Congratulations if you have already made it this far, but there are still decisions to be made, so stay buckled in.

If you’ve narrowed your options to either SOC 1 or SOC 2—both of which are the largest players in the SOC reporting brands—your next step is deciding what type of SOC report you need.

By opting for either SOC 1 or SOC 2, you’ve decided the nature of controls you’re going to have evaluated—SOC  1 centering on those that impact financial reporting and SOC 2 focusing on more operational and security controls—but what does picking a type mean?

Even with the particular SOC report picked out, there are still so many things you need to do to finalize your direction and even your internal controls. But what if we told you that by settling on a type of SOC report, you’ll be able to:

• Roughly discern your audit timeline;
• Determine what about your controls will be tested;
• Influence the effort that will be necessary from both your auditors and from your internal resources; and
• Gain a clearer picture on audit cost?

To reap these bits of critical information, it’s as easy as picking a type. But to do that, you need to understand the differences in what each can provide you, and that’s a breakdown we are going to provide in this article. As SOC audit providers since the inception of the brand, we at Schellman are well-versed on all the decisions that play into an organization’s compliance journey, having had thousands of these discussions with clients and prospects on what’s best for them.

Let’s get some of those decisions made for you by learning all about the different needs and yields of both Report Type directions. Afterwards, you’ll be that much further along in your SOC journey.

Type 1 in SOC Reports

First things first, the Type 1. A report of this kind is going to evaluate the particulars of how well designed your policies, processes, and procedures are, as well as how they’ve been implemented.

How does that work, you may ask?

• This audit is reported on as of just one day—or as we say in the business, as of the report date. Because it’s only checking on that design and implementation, a Type 1 report basically represents a quick look and confirmation that yes, you appear to be doing what you say you’re doing in terms of your control environment.
• Think of it like looking at a car you might buy—it looks like a well-maintained car, sounds like a car, feels like a quality car, so if you did go ahead and purchase it, you can be certain you’d be getting a reliable car.
• Again, because it’s only as of a specific date, that translates to less effort from both the resources you’ll need to tap internally to satisfy the audit, as well as less effort from the third-party auditors you bring in. That translates to lower professional fees.

(It’s also important to note that though the moniker of “Type” is limited to just SOC 1 and SOC 2, similar nomenclature applies to SOC for Supply Chain and SOC for Cybersecurity as well. It may be officially called something else over there, but these other SOC reports also allow for a point-in-time assessment similar to a Type 1.)

Type 2 in SOC Reports

Onto the next—to put it simply, where Type 1 gives you a little, a Type 2 report gives you a lot. Generally recognized as the more thorough of the SOC report types, the Type 2 option takes into account all of the same criteria evaluated in Type 1 but takes it further.

How? Type 2 audits not only account for the design and implementation of your controls, but they also test their operating effectiveness over a period of time. 

• What does that mean? Over a Type 2 audit, your controls will be assessed to ensure they are actually functioning and not just designed well and in place.
• To account for that, Type 2 reports are evaluated over a reporting period. Though it’s usually  a minimum of six months, sometimes it can vary, depending on other factors that affect a particular organization.
• The longer reporting period, coupled with the extensive operational testing, requires a lot more investment from your personnel and your auditors, so be aware that’ll drive your efforts and your fees up at the end of the day.
• Let’s take that same car metaphor from before and apply it to Type 2 audits. The car still looks, feels and sounds good on the lot, but this time, you take it for an extended test drive, and it finishes the stint with everything working well. That’s a little bit of a different level of assurance before your purchase, wouldn’t you say?

Wait, Does a Type 1 Hold Any Value?

Now given all that, you may be wondering if a Type 1 report—the one that just looks at one day—is worth it. Your customers want assurance, so on paper, it’s an obvious tipping of the scales in favor of the Type 2, given that it contains the same information as a Type 1 report while also adding the tests of operating effectiveness over a period.

It may surprise you to learn that Type 1 does still have a case, in some instances. Most importantly, as a safety net.

For instance, let’s say you have a client obligation coming up quickly—they want a completed SOC report, but they want it before a point that allows you time for the extended Type 2. During times like these, a Type 1 can serve as a handy substitute in the short term. The Type 1 reports do still provide a certain level of assurance, and they can also allow you to fulfill that request more quickly if your scheduling is jammed.

Plus, those results further enable an established service/product assurance you can present to prospects. They can also help you form a control set that can be matured and eventually bridge to a Type 2.

What is the difference between a Type 1 and a Type 2 SOC Report?

Which Type Do I Need?

It’s true—many organizations do not consider the types of SOC reports as separate directions, but rather two different yet sequential steps on the way to compliance. Many organizations do opt for both a Type 1 and Type 2 for the same scope, even throwing in a readiness assessment as a prerequisite to minimize risk, but it all depends on your company’s characteristics, budget, and individual obligations.

That’s everything in compliance—the direction you take in this arena will be determined entirely by your individual needs. At the very least, when it comes to SOC 1 or SOC 2, it’s nice to have Type options with unique features that can be leveraged for different benefits.

That’s why it’s time to look inward and consider those particulars of your organization that’ll dictate which direction you choose.

• What are your customers saying? First things first, right? Because if they already know what they want, specifically down to the type—that’s a wrap, the decision is made.

Otherwise:

• What kind of system or service are you wanting to be evaluated by a service auditor? If it’s brand new, maybe a readiness or Type 1 is the way to go just to make sure your control foundation is good.
• What’s the timeline you’re on? If there are reasons you need to get going sooner rather than later, that might mean choosing one type over the other.
• What do your internal resources look like at the moment? Recall that we said that Type 2 reports require more effort than their sister. Does your organization have the bandwidth to support the Type 2 audit right now, or would a simpler endeavor work best?

Answer all that, and you’ll be well-ready to move along in your SOC journey, though your next steps could take a couple different directions.

If you’d like to go ahead and speak with an auditor, Schellman personnel are ready and eager to learn about the particulars of your organization and offer advice as to what services may suit you best. But if you’d rather continue your research first, we’re happy to help there as well. For more information on SOC reports, check out these links as we continue to add them:

• What Does a SOC Audit Cost?
• What are the SOC 2 TSCs?
• What is the Process of a SOC Examination?