BLOG

What is the Difference Between SOC 1 Type I and SOC 1 Type II?

by Joseph Kirkpatrick / June 16th, 2017

You know you need a SOC 1 audit report, but do you need a SOC 1 Type I or a SOC 1 Type II?

What’s the difference? Which one makes the most sense for your organization?

Read more to understand the importance of a SOC 1 audit report and the differences between a Type I and a Type II audit report.

What is a SOC 1 Audit?

A SOC 1 audit, or System and Organization Control 1 engagement, is an audit of internal controls at a service organization that may affect their clients’ internal control over financial reporting (ICFR). A SOC 1 audit report provides user entities with reasonable assurance and the peace of mind that the controls at a service organization are operating effectively and appropriately protecting client data.

There are two types of SOC 1 audit reports: SOC 1 Type I and a SOC 1 Type II.

SOC 1 Type I vs. SOC 1 Type II: What’s the Difference?

There are both similarities and differences between a SOC 1 Type I and a SOC 1 Type II audit report. As a CPA firm, we commonly advise clients who are engaging in a SOC 1 audit for the first time to begin with a Type I and move on to a Type II the following audit period. This gives service organizations a good starting point, allowing them to mature their environment over time.

A SOC 1 Type I and a SOC 1 Type II both report on the controls and processes at a service organization that may impact their user entities’ internal control over financial reporting. The main difference is that:

• A SOC 1 Type I report is an attestation of controls at a service organization at a specific point in time…
• Whereas a SOC 1 Type II report is an attestation of controls at a service organization over a minimum six-month period.

The SOC 1 Type I reports on the description of controls provided by management of the service organization and attests that the controls are suitably designed and implemented. The SOC 1 Type II reports on the description of controls provided by management of the service organization, attests that the controls are suitably designed and implemented, and attests to the operating effectiveness of the controls.

Many organizations are required to undergo a third-party SOC 1 audit. If you have questions about which type of SOC report you need or want help demonstrating to your clients your commitment to security and compliance, contact us today. 

More SOC 1 Resources

Understanding Your SOC 1 Report Video Series 

SOC 1 Compliance Checklist: Are You Prepared for an Audit? 

How to Read Your Vendors SOC 1 or SOC 2 Report? 

The SSAE 18 (formerly SSAE 16), otherwise known as the SOC 1 report, is available in two types of reports: there’s a Type I Report, and a Type II Report. The Type I Report issues an attestation on the description of controls provided by management of the service organization, and there’s also an attestation that the controls are suitably designed and implemented. For a Type II Report, you have those two same sections in the report, plus an additional section that talks about the operating effectiveness of those controls over a period of time.

The Type II Report is concerned about that period of time, whereas a Type I Report is “as of a particular date.” So, your controls could be in place as of a particular date for a Type I Report, whereas for a Type II those controls must be in place and operating effectively over a period of time determined by you and the auditor that is involved in performing the engagement.