SOC 1 vs SOC 2 Reports: Purpose, Scope and Differences
By SimplyCPA · 11 October 2026
On this page (5)
- SOC 1: Reports on a service organisation's controls relevant to its user entities' internal control over financial reporting. Used by user entities and their auditors.
- SOC 2: Reports on controls relevant to security, availability, processing integrity, confidentiality or privacy (the Trust Services Criteria). Used by customers, regulators and partners.
- Type 1: Fairness of the system description and suitability of control design, as of a point in time.
- Type 2: Adds operating effectiveness of controls over a period, usually 6–12 months. It's the version user auditors can rely on to reduce control risk.
- SOC 3: A short, general-use version of SOC 2 that can be shared publicly.
Why SOC reports exist
Companies outsource payroll, cloud hosting, claims processing and much more to service organisations. Their auditors still need assurance about controls they can't see. Rather than every customer's auditor visiting the provider, the provider hires a CPA firm to report once, and shares that System and Organization Controls (SOC) report with its customers.
SOC 1 vs SOC 2 vs SOC 3
| SOC 1 | SOC 2 | SOC 3 | |
|---|---|---|---|
| Subject | Controls relevant to user entities' financial reporting | Controls relevant to security, availability, processing integrity, confidentiality and privacy | Same as SOC 2, summarised |
| Criteria | Control objectives set by the service organisation | AICPA Trust Services Criteria | AICPA Trust Services Criteria |
| Intended users | User entities and their auditors | Knowledgeable users — customers, prospects, regulators | General use |
| Typical example | A payroll processor | A cloud software or data centre provider | A trust seal on a website |
Type 1 vs Type 2
- Type 1 — management's description of the system is fairly presented and controls are suitably designed, as of a specific date.
- Type 2 — all of the above, plus the controls operated effectively throughout a period. It includes the service auditor's tests and results.
A user auditor can use a Type 1 report to understand the controls, but only a Type 2 report gives evidence of operating effectiveness that can reduce assessed control risk.
Things the user auditor must check
- Period covered — does it overlap the client's fiscal year? If there's a gap, a bridge letter from the service organisation and other procedures may be needed.
- Complementary user entity controls (CUECs) — controls the user entity must operate itself for the service organisation's controls to work. The user auditor tests these at the client.
- Subservice organisations — under the carve-out method they're excluded from the report; under the inclusive method they're covered.
- Exceptions and the opinion — deviations noted in testing and any modified opinion from the service auditor.
Exam trap: In an audit report, the user auditor does not refer to the service auditor's report as a basis for its own opinion. Responsibility isn't divided the way it can be with component auditors.
SOC engagements appear in both AUD and the ISC Discipline. See attestation and SOC engagements and ISC SOC engagements.