Written by Lauren Pankey, BMSS Manager
Most service organizations are prompted by their customers’ procurement or compliance teams to provide a SOC 2 or SOC 1 Type II report. A SOC 1 report evaluates internal controls that affect a customer’s financial reporting (such as billing or claims) and a SOC 2 report evaluates IT general controls. For a Type I, BMSS evaluates whether the service organization’s controls are designed appropriately at a single point-in-time. For a Type II, BMSS evaluates whether the service organization’s controls are designed appropriately and operating effectively over a period of time (typically 3 to 12 months). The Type II provides more assurance as it is evaluating the controls over a time period rather than at one specific date. Typically, customers will prefer a Type II over a Type I report. A Type I and Type II can be conducted for both a SOC 1 and SOC 2 report.
What Is a Type I Report?
The auditor determines if the controls are designed correctly on a single, specified date. A Type I does not conclude if the controls are operating over a period of time. Key reasons to get a Type I are: a fast turnaround (a great option if you need to close a customer deal or if your customer has an immediate contract requirement); it is a precursor for a Type II examination; and it allows you to work with your auditor to ensure your policies and procedures are structured appropriately before investing in a Type II report. It also requires less documentation as historical evidence is not required. The downside to a Type I report is that it does not tell your readers how your controls operated over a period of time; therefore, they will likely require a Type II in the future.
Pros to a Type I:
- Faster completion time from design to report in hand
- Lower cost as it requires fewer auditor hours and less evidence collection
- Practical baseline for first-time reports to validate control design
- Early compliance proof for newer companies and start-ups to quickly demonstrate that a control framework exists
- Identification of design gaps and flaws before undergoing a deeper operational audit
Cons to a Type I:
- No proof of operational effectiveness over a period of time
- Limited customer acceptance as some customers will demand a Type II
- Possible delay of contracts with heavily regulated customers
What Is a Type II Report?
The auditor determines the design and operational effectiveness of an organization’s controls over a defined period of time (typically 3 to 12 months) during a Type II audit. A Type II report proves that the controls functioned day-to-day over the review period window. During fieldwork, the independent CPA auditor will test the service organization’s controls across the entire review period window using several standard audit procedures. These typically include inspections, observations, inquiries, and recalculation / reperformance testing. BMSS will use sampling for controls that happen repeatedly (background checks for new hires, monthly access reviews, approval of source code changes). For the sampled instances, the service organization must provide dated evidence proving the control occurred. A first-year review period of three to six months is common, with 12 months thereafter, though some customers ask for longer.
Pros to a Type II:
- Higher customer trust as Type II reports provide assurance that controls actually work over time
- Detection of control failures or misconfigurations that a Type I would miss
- Reduced security questionnaires or vendor assessments
- Enhanced internal security maturity
Cons to a Type II:
- Higher cost as the auditors must sample test over a period of time
- Longer timeline as you must wait out the review period window plus readiness and testing time
- Requires buy-in from resources and staff as evidence collection must be continuously collected and stored
Side-by-side Comparison
| SOC Report Type | Type I | Type II |
| What’s tested | Design of controls | Design and operating effectiveness |
| Time frame | Point-in-time | Period of time (typically 3 to 12 months) |
| Level of assurance | Lower | Higher |
| Evidence required | Policies, configurations, system description, evidence that controls are in place of the report date | Samples of evidence across the review period |
| Effort and cost | Lower | Higher |
| Customer acceptance | Sometimes accepted as a starting point | Generally preferred or required |
What Is Inside a Type I vs. Type II Report?
Type I
The Type I report includes: An auditor’s opinion; management’s assertion (asserting that the controls are designed and implemented properly as of a specific date); the system description describing the system in scope including a narrative explanation; and the control objectives or criteria mapped against the relevant standards (such as the AICPA Trust Services Criteria for SOC 2 or financial reporting controls for SOC 1).
Type II
The Type II report contains all of the same foundational sections of a Type I report, plus testing results. Detailed testing procedures and results are documented within the report including the auditor’s expanded opinion on operating effectiveness of the controls throughout the review period window. Also included within the Type II report is a description of exceptions detailed in the report, if any were found. Management may add a response explaining the cause and corrective action.
The Common Path: Type I, Then Type II
For newer or start-up companies, or even first-time reports, the typical path to a SOC report moves from an initial readiness assessment to a Type I report and then transitions into a Type II report as your controls mature and are defined. A Readiness Assessment is a pre-assessment to evaluate your current processes and policies. The goal is to identify missing policies and procedures in place and typically lasts a few weeks from start to finish. A Type I report is best for early-stage companies that need a quick report to show to their customers, typically taking about three months from start to finish. This includes minimal testing to confirm the control is suitably designed. The Type II report is best for proving long-term security posture and typically takes about 6-15 months in total, including the review period window and reporting.
FAQ
- Can we skip the Type I and go straight to a Type II? For a first-time report, BMSS recommends the Type I first to identify gaps and control failures before jumping straight into a Type II as the control deviations and failures must be recorded within the Type II report. It makes sense to skip the Type I if you have a mature control environment.
- Do we need a Type II report every year? In practice, yes. You need a Type II report annually to show controls remain effective. The market standard is every 12 months and any report outside of 12 months is considered “stale”.
- Does a Type II report cost more? Yes, a Type II report costs more as there is an extended review period window and more evidence gathering. The drivers for the cost of a SOC report are the scope, number of applications, number of criteria (SOC 2), size of the company, and automated versus manual controls in place.
- Does BMSS work with compliance automation platforms? Yes. We will work directly within the GRC platform you are already using to help streamline evidence collection and review. We have worked with Drata, Vanta, Secureframe, Sprinto, Hyperproof, Anecdotes, AuditBoard, OneTrust, and more.
- What if my report is more than 12 months old? BMSS can provide a Bridge Letter that covers a short, temporary gap between the end of the latest SOC (System and Organization Controls) report and the customer’s fiscal or calendar year end. However, the Bridge Letter carries no independent verification or auditor’s opinion.
If you would like more information about SOC reports and what may be applicable for your company, please reach out to our SOC team by calling (833) CPA-BMSS or visit our website for more details.
