Distinguishing SOC 1, SOC 2, SOC 3, Type 1, and Type 2 Reports

SOC reports are attestation reports on controls at service organizations. They matter because user entities often outsource payroll, benefits administration, cloud hosting, payment processing, or other functions that affect financial reporting or system reliability.

The AUD exam tests two separate distinctions. First, identify whether the report is SOC 1, SOC 2, or SOC 3. Second, identify whether the report is Type 1 or Type 2.

    flowchart TD
	    A["Service organization controls"] --> B{"User concern"}
	    B -- "Controls relevant to user financial statements" --> C["SOC 1"]
	    B -- "Security, availability, processing integrity, confidentiality, or privacy" --> D["SOC 2"]
	    B -- "General-use public summary of SOC 2 subject matter" --> E["SOC 3"]
	    C --> F{"Timing"}
	    D --> F
	    E --> F
	    F -- "As of a date" --> G["Type 1: design only"]
	    F -- "Over a period" --> H["Type 2: design and operating effectiveness"]

SOC Report Types

SOC 1 is about financial statement audit relevance. SOC 2 is about trust services controls. SOC 3 is the public-facing, less detailed version tied to SOC 2-type criteria.

SOC 1 Reports

A SOC 1 report helps user auditors understand controls at a service organization that may affect a user entity’s financial statements. Payroll processors, claims processors, loan servicers, and transaction processors are common examples.

User auditors use SOC 1 reports to:

• Understand outsourced processes relevant to the audit.
• Identify controls at the service organization.
• Evaluate whether complementary user entity controls are needed.
• Decide whether the report supports reduced control testing at the service organization.
• Consider whether additional procedures are needed for user-entity audit risks.

A SOC 1 report does not provide assurance over general cybersecurity unless those controls are relevant to user financial reporting.

SOC 2 and SOC 3 Reports

SOC 2 reports address controls using the Trust Services Criteria. Security is common to all SOC 2 reports; availability, processing integrity, confidentiality, and privacy may be included when relevant to the service commitment.

SOC 3 reports cover similar subject matter at a higher level and are designed for general distribution. They do not provide the same detailed control descriptions and test results that user entities receive in a SOC 2 report.

Type 1 vs. Type 2

Type 1 and Type 2 are timing and evidence distinctions, not SOC 1 versus SOC 2 distinctions.

If a user auditor wants evidence that controls operated effectively during the audit period, Type 2 is usually more useful than Type 1.

Complementary Controls and Subservice Organizations

SOC reports often identify controls that must exist outside the service organization.

The user auditor cannot rely on a SOC report mechanically. The auditor must consider whether complementary controls at the user entity are designed and operating.

Choosing the Right SOC Report

The exam trap is choosing SOC 2 simply because a system is computerized. If the outsourced system affects user financial statements, SOC 1 may be the relevant report for the user auditor.

Exam Traps

• SOC 1 relates to user entities’ financial statement audits.
• SOC 2 relates to Trust Services Criteria, not GAAP financial statement assertions.
• SOC 3 is general use and less detailed than SOC 2.
• Type 1 is as of a date; Type 2 covers a period.
• Type 2 includes operating effectiveness; Type 1 does not.
• Complementary user entity controls still matter.
• A SOC report does not eliminate all audit procedures at the user entity.

Quick Review

Use this sequence for SOC questions:

1. Identify the user need: financial reporting, trust services controls, or public summary.
2. Select SOC 1, SOC 2, or SOC 3.
3. Decide whether the question asks for design as of a date or operating effectiveness over a period.
4. Select Type 1 or Type 2.
5. Consider complementary user entity controls.
6. Avoid assuming a SOC report removes all user-auditor responsibility.

Review Questions