Type I vs Type II SOC Reports: What CPA Candidates Must Know
By SimplyCPA · 11 October 2026
On this page (5)
- Type 1: Opinion on the fairness of the system description and the suitability of control design, as of a specific date.
- Type 2: Adds an opinion on operating effectiveness over a period, plus the service auditor's tests and results.
- Report sections: Service auditor's opinion, management's assertion, the system description, tests and results (Type 2 only) and optional other information.
- User auditors: Only a Type 2 report provides evidence that controls operated effectively, which can reduce assessed control risk.
- Gaps: If the report period doesn't cover the client's year-end, the auditor obtains a bridge letter and performs additional procedures.
Type 1 vs Type 2 at a glance
| Type 1 | Type 2 | |
|---|---|---|
| Covers | A specified date | A specified period (commonly 6–12 months) |
| Fair presentation of the system description | Yes | Yes |
| Suitability of control design | Yes | Yes |
| Operating effectiveness of controls | No | Yes |
| Description of tests and results | No | Yes |
| Typical use | First-year reports, new systems | Ongoing assurance for customers and user auditors |
The same Type 1/Type 2 distinction applies to both SOC 1 (controls relevant to user entities' financial reporting) and SOC 2 (controls relevant to security, availability, processing integrity, confidentiality or privacy). See SOC 1 vs SOC 2.
What's inside a SOC report
- Independent service auditor's report — the opinion.
- Management's assertion — the service organisation's own claims about the description and controls.
- Description of the system — services, infrastructure, software, people, procedures, data, the control objectives (SOC 1) or criteria (SOC 2), and complementary user entity controls.
- Tests of controls and results (Type 2 only) — each control, the test performed and any deviations.
- Other information provided by the service organisation, which is not covered by the opinion.
Possible opinions
The service auditor's opinion can be unmodified, qualified, adverse, or a disclaimer — for example, qualified if a control objective wasn't achieved because a control didn't operate effectively. The performing standards are the AICPA's attestation standards (AT-C 320 for SOC 1 examinations; AT-C 105 and 205 for SOC 2).
How a user auditor uses the report (AU-C 402)
- Check the type — only Type 2 supports reliance on operating effectiveness.
- Check the period against the client's fiscal year. For gaps, obtain a bridge letter (a management representation from the service organisation that nothing has changed) and consider additional procedures.
- Read the exceptions and assess their effect on the client's risk assessment.
- Test the complementary user entity controls (CUECs) at the client.
- Consider subservice organisations — whether they are carved out or included.
- Evaluate the service auditor's professional reputation and competence where relevant.
Exam trap: A user auditor's report doesn't refer to the service auditor's work as a basis for its opinion, even if it relied heavily on a Type 2 report.
Study further in ISC SOC engagements and AUD attestation and SOC engagements.