What is Type 1 and Type 2 reports?
In short
A Type 1 System and Organization Controls (SOC) report covers the description of a service organization's system and the suitability of its control design at a point in time. A Type 2 report adds the operating effectiveness of the controls over a period.
Key takeaways
- A Type 2 report describes the tests performed and their results.
- A user auditor who plans to rely on the service organization's controls needs a Type 2 report.
- Both types exist for SOC 1 and SOC 2 reports.
Where it's tested
ISC: System and Organization Controls (SOC) Engagements — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
In a SOC 2 Type 2 report, the service auditor's opinion covers: