SOC 1 vs SOC 2: which report does your customer want?

SOC stands for System and Organization Controls, a family of reports defined by the AICPA. A SOC 1 report is a CPA firm’s opinion on a service organization’s controls that are relevant to its customers’ internal control over financial reporting. If a mistake in your system could put a wrong number in a customer’s financial statements, their auditor cares about your controls, and a SOC 1 report is how you show them once instead of hosting every customer’s auditor.

The usual SOC 1 candidates are payroll processors, benefits and claims administrators, loan servicers, payment and billing platforms, fund administrators and the hosting providers behind them. Public company customers lean on SOC 1 reports when they test internal controls for Sarbanes-Oxley.

There is no fixed list of SOC 1 criteria. You write control objectives, such as “payroll changes are authorized and processed accurately”, and the controls that meet them. Most reports pair business process controls with IT general controls: access, change management and computer operations.

A SOC 2 report tests your controls against the AICPA Trust Services Criteria. Security is always in scope, through 33 common criteria grouped CC1 to CC9. Availability, processing integrity, confidentiality and privacy are optional categories you add when a customer or a contract calls for them. The control list a small company usually ends up with is in our SOC 2 compliance checklist, and the framework itself is on our SOC 2 page.

The reader is different too. A SOC 2 goes to customers’ security reviewers, procurement teams and sometimes their regulators, usually under an NDA. It answers one question: can we trust this vendor with our data?

The Type 1 and Type 2 split works the same way in both: a Type 1 tests the design of your controls on one date, a Type 2 tests that they operated over a period, usually 3 to 12 months. Our guide to SOC 2 Type 1 vs Type 2 covers the choice in detail, and the SOC 2 fee figures come from our SOC 2 auditor guide.

Neither. They answer different questions, so the better report is the one your customer asked for. Three quick tests settle it:

1. Does your service feed a customer’s financial statements? Payroll, billing, revenue, claims, investments, general ledger data. If yes, expect a SOC 1 request.
2. Do you store or process customer data? Almost every SaaS company, MSP and data processor does. That is a SOC 2 question.
3. Who sent the request? A controller or an external audit firm usually wants SOC 1. A security questionnaire or a procurement checklist usually wants SOC 2.

If the request just says “a SOC report”, ask. It costs one email and can save you an audit you did not need.

Only if a customer’s financial auditor needs it. A SOC 2 does not test control objectives over financial reporting, so it does not replace a SOC 1, and a SOC 1 does not answer a security review.

The good news for a company that needs both: the IT general controls overlap. Access reviews, change approvals, backups and offboarding records serve both reports, and many CPA firms will scope the two audits over the same period so the testing runs once where it can. Plan the period with the firm before it starts. What the SOC 2 side costs in total is broken down in SOC 2 cost and hidden costs.

A SOC 3 report covers the same Trust Services Criteria as a SOC 2 but leaves out the detail: no description of each control, no list of tests, no results. That makes it a general-use report you can post on your website. Security reviewers rarely accept it in place of a SOC 2, because the detail is what they read. It is a marketing document backed by a real audit, and it is usually issued alongside a SOC 2 by the same firm.

SOC 1 and SOC 2 reports share one structure. If you have never seen one, this is the order you will read it in:

1. The auditor’s opinion. One to three pages. Unqualified is the clean result.
2. Management’s assertion. Your signed statement that the description is fair and the controls were designed, and in a Type 2 operated, as described.
3. The system description. Your services, infrastructure, software, people, data and processes, plus the boundaries of what is in scope.
4. Controls, tests and results. Each control mapped to a control objective (SOC 1) or a criterion (SOC 2), with the auditor’s test and any exceptions. A Type 1 has no operating test.
5. Other information. An optional, unaudited section, often used to respond to exceptions.

Two lists in the description matter more than they look. Complementary user entity controls are the controls your customers must run for the report to hold, such as reviewing who in their company has access to your product. Complementary subservice organization controls are the ones you rely on your own providers for, such as your cloud host. Reviewers read both to see what they inherit. How a Type 2 is tested is in SOC 2 Type 2 explained, and the terms above are defined in our compliance glossary.