SOC 2 Type 1 and Type 2: A Quick Overview

June 22, 2015 Debbie Zaller

Can you provide a quick overview on what a SOC 2 examination is and the difference between a Type 1 and Type 2 report?

In early 2011, the AICPA issues its Service Organization Control (SOC) reporting framework. The purpose of this framework is to differentiate between the common types of AICPA reports that service organizations are expected to provide to their customers. A SOC 2 report, titled “Report on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality or Privacy” is designed to meet a broad set of reporting needs about the controls at a service organization in the form of a CPA firm’s independent attestation report. The scope of a SOC 2 report is determined by the client and the auditor utilizing one or more of the Trust Service Principals (TSP's), discussed above, as specified by the client to determine whether an information system operated by the client utilizes sufficient control activities to meet the specified criteria for the selected principles. The client also specifies whether a “Type 1” or “Type 2” examination will be performed for the SOC 2 report.

BrightLine performs a “Type 1” SOC 2 examination when management requires a report on the fairness of presentation of the service organization’s system and the suitability of the design of controls as of a specified date.

A “Type 2” SOC 2 examination is performed when management requires a report on the fairness of presentation of the service organization’s system and the suitability of the design and operating effectiveness of controls over a period of time. The resulting report is a restricted use report that should only be used by third parties sufficiently familiar with the system.

About the Author

Debbie Zaller

Debbie Zaller is a Principal at Schellman & Company,LLC. Debbie leads the SOC 2 and SOC 3 service line and is also an AICPA SOC Specialist. Debbie has over 15 years of IT attestation experience and currently spearheads Schellman’s SOC 2 practice, where she is responsible for internal training, methodology creation, and quality reporting. Debbie was a past member of the Florida Institute of Certified Public Accountants’ Board of Governors and served on the Finance and Office Advisory Committee.

More Content by Debbie Zaller
Previous Article
Can An Organization Keep Using The Old TSPs?
Can An Organization Keep Using The Old TSPs?

My company completes SOC 2 audits annually, and have for the last several years based on the old trust crit...

Next Article
Can a SOC 1 be leveraged for a SOC 2?
Can a SOC 1 be leveraged for a SOC 2?

Technology based service organizations have seen the SOC 2 report gain immense traction over the past coupl...