Additional Contributors
PYA Takeaway: Organizations considering SOC 1 and SOC 2 reports should understand the differences between them. A SOC 1 report evaluates controls relevant to a customer’s financial reporting. A SOC 2 report evaluates controls related to the security, availability, processing integrity, confidentiality, and/or privacy of systems and data. The right report depends on the risks created by the organization’s services and the assurance customers or their auditors need.
System and Organization Controls (SOC) examinations are conducted by independent, third-party, licensed certified public accounting (CPA) firms to assess the effectiveness of an organization’s internal controls. These examinations result in SOC 1 or SOC 2 reports. Organizations pursuing a SOC audit often arrive at the same question: Do we need to obtain a SOC 1 report, a SOC 2 report, or both?
The answer depends on the services the organization provides, the risks those services create for customers, and the type of assurance stakeholders are seeking. The primary difference between the two reports is the type of risk being evaluated:
- SOC 1 reports address controls relevant to financial reporting
- SOC 2 reports address controls related to the security and protection of systems and data
Both SOC 1 and SOC 2 examinations may be performed as either a Type I or Type II engagement. Type I engagements address the design of controls at a point in time, and Type II engagements evaluate operating effectiveness over a specified period.
For organizations evaluating SOC reporting for the first time, the questions below can help clarify which report may be the right fit. For a broader overview of the SOC reporting options, see PYA’s article, How to Choose the Right SOC Report to Build Trust and Support Compliance.
What Is a SOC 1 Report?
A SOC 1 report is designed for service organizations that perform outsourced services on behalf of customers when those services may affect the customers’ financial reporting processes. This commonly includes organizations that process transactions or support activities that ultimately flow into a customer’s financial statements. External auditors frequently request SOC 1 reports from their clients.
Examples of organizations that frequently need SOC 1 examinations include:
- Payroll providers
- Claims processors
- Fund administrators
- Revenue cycle management companies
- Software providers that process, calculate, or maintain financial data used in customers’ financial reporting, such as general ledger, payroll, billing, and accounts payable/receivable platforms
Importantly, controls that support financial reporting often involve more than just accounting processes. Organizations often rely on information technology general controls (ITGCs), including user access management, change management, and system operations controls, to support the reliability of financial information. These controls are therefore frequently included within the scope of a SOC 1 examination.
What Is a SOC 2 Report?
A SOC 2 report addresses controls over the security and operational integrity of an organization’s systems and data. These examinations are performed against the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria and are used when customers seek assurance that systems and data are protected and that appropriate controls operate within the service organization’s environment.
Security, often referred to as the common criteria, is required in every SOC 2 examination. The four additional criteria are selected based on the services provided and the commitments made to customers. A SOC 2 can contain any or all of these four criteria:
- Availability
- Processing integrity
- Confidentiality
- Privacy
SOC 2 reports are frequently used by:
- Software-as-a-Service (SaaS) providers
- Managed service providers
- Cloud hosting providers
- Data centers
- Healthcare technology organizations
- Cybersecurity and managed detection providers
Can a SOC 2 Replace a SOC 1 for Financial Statement Audit Purposes?
In most cases, the answer is “no.” A SOC 2 report addresses controls over the security and operational integrity of an organization’s systems and data, not controls relevant to internal control over financial reporting (ICFR). As a result, a SOC 2 report is not intended to replace a SOC 1 report when customers require assurance over financial reporting risks.
SOC 1 vs. SOC 2 at a Glance
| Consideration | SOC 1 | SOC 2 |
| Typical Audience | Customer management and financial statement auditors | Customers, procurement teams, compliance professionals, and vendor risk management groups |
| Control Areas | Transaction processing (input, processing, output, and reconciliation), ICFR-related business process controls, and supporting ITGCs such as access, change management, and operations | Security (required), plus availability, processing integrity, confidentiality, and privacy as applicable to the services provided |
| Common Industries | Payroll providers, claims processors, fund administrators, revenue cycle management companies, outsourced accounting providers, and software platforms that process, calculate, or maintain financial data used in customers’ financial reporting, such as general ledger, payroll, billing, and accounts payable/receivable solutions | SaaS, technology, cloud hosting, managed services, data centers |
| Report Use and Distribution | Both are restricted-use reports intended for knowledgeable parties, not for public distribution or marketing; a SOC 3 serves that purpose, as described below. | |
When Would an Organization Choose a SOC 3 Report?
Organizations pursuing a SOC 2 examination may also consider obtaining a SOC 3 report. A SOC 3 report is a general-use report based on an examination performed under the AICPA Trust Services Criteria and is typically issued when an organization wants a publicly distributable summary of the service auditor’s opinion. It provides a high-level summary of the service organization’s system and the service auditor’s opinion, without the detailed description of controls, tests performed, and results included in a SOC 2 report.
Because the opinion in a SOC 3 report addresses the operating effectiveness of controls over a period of time, a SOC 3 is based upon the same examination as a SOC 2 Type II report. Distribution is not restricted, so a SOC 3 can be shared publicly or with prospective customers. The SOC 2 remains available to those parties who need the detailed information.
When Would an Organization Need Both SOC 1 and SOC 2?
Some organizations need both reports because their services impact financial reporting while also processing or storing sensitive information. In many cases, the same controls can support both SOC 1 and SOC 2 examinations, particularly those related to system access, change management, and IT operations.
Examples may include revenue cycle management companies, healthcare technology platforms, payment and billing providers, benefit administration organizations, business process outsourcing (BPO) providers, fund administrators, and other service organizations that perform critical business processes on behalf of customers while using their own systems and technology.
What Common Mistakes Do Organizations Make When Selecting a SOC Report?
Selecting a SOC report should be driven by the assurance customers are seeking rather than by market familiarity. The missteps below occur most frequently and often result in unnecessary cost, rework, or a report that does not meet customer needs:
- Assuming a SOC 2 is needed. SOC 2 is widely requested, but it does not address ICFR. If your services affect customer financial reporting, a SOC 1 may be required instead of, or in addition to, a SOC 2.
- Ignoring customer auditor requirements. Customers’ financial statement auditors often expect a SOC 1 Type II report with a review period that covers a substantial portion of the customer’s fiscal year. Confirming these expectations early helps avoid coverage gaps that require additional audit procedures.
- Waiting until procurement requests arrive. An initial Type II report is not a quick turnaround. Controls must be designed, implemented, and remediated before the examination period can begin. That period typically lasts at least six months and is followed by testing, report drafting, and issuance. The whole process can take a year or more, so starting early helps avoid delays in closing new business or renewing contracts.
- Treating the examination as a compliance exercise. A SOC examination evaluates the controls a service organization has actually implemented. It is not a checklist of audit steps. Controls built to satisfy the auditor, instead of reflecting how the organization really operates, are more likely to fail during the examination period and lead to exceptions in the report. Building controls into daily operations strengthens both the report and the underlying control environment.
- Selecting a provider based solely on cost. SOC examinations must be performed by a licensed CPA firm, and the firm’s experience with your industry, systems, and customer expectations affects how well the engagement is scoped, executed, and communicated. An experienced provider can help identify potential issues earlier, align testing procedures with stakeholder expectations, and deliver a report that meets the level of scrutiny often applied by customers, prospects, and business partners. While a lower fee may seem attractive, the potential costs associated with rework, audit delays, gaps in coverage, or a report that does not instill customer confidence can exceed the initial savings.
Key Takeaways
Selecting the appropriate SOC report begins with understanding how your services affect the customers that you serve. As you evaluate your options, keep the following in mind:
- A SOC 1 report may be the appropriate starting point if your services influence customer financial reporting, and a SOC 2 report may better address customer expectations regarding security, data protection, and operational controls. Organizations whose services affect both areas may benefit from obtaining both reports.
- Only the security criteria are required in a SOC 2 examination. Including criteria that do not apply to your services can add cost without adding value.
- A SOC 1 examination is rarely limited to accounting processes, as the ITGCs supporting those processes are frequently in scope.
- A SOC 2 report does not address ICFR and is not intended to replace a SOC 1 when financial reporting assurance is required.
- Both SOC 1 and SOC 2 reports contain sensitive internal control information and should therefore be treated as restricted-use reports. A SOC 3 is the appropriate report for public distribution.
- Confirming early what your customers and their auditors require allows adequate time for readiness work before a report is requested.
Once an organization receives a report, the next step is understanding how to review a SOC report and evaluate its relevance, controls, exceptions, and user responsibilities.
Getting Help with Your SOC Reporting Decision
The question of which SOC report to pursue sits at the intersection of financial reporting and information security, and it is rarely answered from only one of those perspectives. PYA’s SOC professionals offer financial statement audit experience with IT audit and cybersecurity expertise to evaluate how your services affect customers and what your stakeholders are actually asking your organization to demonstrate.
As part of our Audit & Assurance Services, we perform SOC examinations for service organizations and scope each engagement to the assurance customers are seeking, so the criteria included are the ones that apply. To discuss whether a SOC 1 report, a SOC 2 report, or both are right for your organization, contact a PYA executive.
Sources:
• https://legalclarity.org/what-is-an-aicpa-soc-1-report/
• https://assets.ctfassets.net/rb9cdnjh59cm/72xv4p67HVXKp6CjWmjkPk/1cdbfa19f6307e2720396b66a6194dc9/trust-services-criteria-updated-copyright.pdf
• https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-3
