Written by Lauren Pankey, BMSS Manager
A SOC 1 report covers controls that are relevant to your customers’ financial reporting. A SOC 2 report covers controls that are relevant to data security and data protection. SOC is defined as System and Organization Controls (SOC) Reporting. The standards for SOC reports are defined by the AICPA and are performed by licensed CPAs. Companies get asked for a SOC report because client organizations need to verify independently that the company can handle their sensitive data and verify that the company manages the risk of critical business functions when outsourced to them. SOC 1 and SOC 2 reports come in Type I and Type II forms; see our guide to SOC Type I vs. Type II.
What Is a SOC 1?
The purpose of a SOC 1 report is to provide assurance to customers on controls that could impact the completeness and accuracy of a company’s financial reporting. Common service providers that need a SOC 1 are payroll and payment processors, healthcare billing and claims administrators, outsourced accounting, loan and mortgage services, and data center providers that store financial systems’ data. A SOC 1 report is relied upon by user entities, user entities’ external financial auditors, and internal financial audit teams. Control objectives for a SOC 1 are determined and defined by the service organization.
What Is a SOC 2?
The purpose of a SOC 2 report is to provide assurance over controls relating to the Trust Services Criteria. Security is the standard mandatory criteria that is required for all SOC 2 reports, and service organizations have the option to add Availability, Processing Integrity, Confidentiality, and Privacy, if needed. A service organization may want to add Availability in scope if they want to provide assurance that the system in scope is available for operation and use as agreed upon to customers. Confidentiality may be added if the service organization is handling data that is designated as “confidential” such as trade secrets or proprietary information and wants to provide assurance to their customers that contractual obligations relating to confidential data are being fulfilled. Processing Integrity may be added if the service organization’s system in scope performs calculations or transactions where accuracy is important. Lastly, Privacy may be added if the service organization interacts directly with consumers and holds sensitive personal data within the system in scope (e.g., SSN, health data, names). Common service organizations that need a SOC 2 report are Software-as-a-Service (SaaS) providers, cloud providers, managed service providers (MSPs), fintech and financial service providers, and professional service providers (payroll, HR, etc.). A SOC 2 report is relied upon by stakeholders, procurement teams, security and compliance teams, customers and prospects, and risk management teams.
Which Do You Need?
- SOC 1 report if your services affect your clients’ financial statements and internal controls over financial reporting (ICFR);
- SOC 2 report if you are a technology provider or handling sensitive data for your customers; or
- Both, if the services you provide to your clients affect the client’s financial reporting and transactions and your services involve storing, processing, or securing sensitive data.
Benefits of a SOC 1
The key benefit of getting a SOC 1 report is to assist with your clients’ financial audits and accelerate the process, providing credibility and assurance to your customers regarding their financial controls, and helping strengthen internal financial processes.
Benefits of a SOC 2
A SOC 2 report can help accelerate sales cycles by reducing lengthy vendor questionnaires from procurement teams, provide your company with a competitive advantage over similar companies that do not have a SOC 2 report, and surface security gaps during readiness and testing. SOC 2 and SOC 1 reports serve different purposes and cannot replace each other. Neither report is pass/fail. The auditor issues an opinion (qualified, unqualified, adverse), and any exceptions found in testing are described in the report. An unqualified opinion can still include exceptions.
Common Misconceptions
SOC 2 is not a certification, it is an attestation report provided by an independent CPA. The CPA does not issue a “certificate” for these reports. The report is an attestation that includes an opinion on whether the controls were designed and operating effectively.
There is no pass or fail. The opinion can be an unqualified, qualified, or adverse opinion.
Using a cloud or subservice provider does not automatically mean you inherit their compliance. Service organizations must still review their own user entity control responsibilities.
Side-by-side Comparison
| Reports | SOC 1 | SOC 2 |
| Focus | Financial reporting controls | Security and data protection |
| Primary audience | Customers’ financial auditors | Customers’ security and compliance / procurement teams |
| Criteria | Control objectives you define | Trust Services Criteria (Security, Availability, Confidentiality, Privacy, Processing Integrity) |
| Common industries | Payroll, payments, billing, and claims | SaaS, cloud, IT services |
| Report types | Type I / Type II | Type I / Type II |
| Distribution | Restricted use | Restricted use |
FAQ
- Can we get both reports? Yes, a service organization can get both a SOC 1 and SOC 2 report. Many IT general controls (ITGCs) overlap between the two frameworks. Conducting the SOC 1 and SOC 2 audits at the same time can reduce redundancies and allow the auditors to leverage evidence.
- How often should the reports be conducted / be renewed? After the completion of a Type I, if needed, the SOC 1 and SOC 2 reports should typically be conducted annually. Many organizations start with a Type I, move to a first Type II, then renew with a Type II every 12 months.
- How long is a SOC 1 and SOC 2 report valid? The reports do not have an expiration date set by the AICPA; however, most procurement teams will expect to receive an updated report annually and see them as valid for 12 months from the end of the review period.
- Can I share my report publicly? No. The reports are restricted disclosure and are typically shared under a Non-Disclosure Agreement (NDA); however, service organizations can request a SOC 3, which is a public-facing general use document without the technical details of a SOC 2 Type II report. A SOC 3 report is based on the SOC 2 Trust Services Criteria and has no SOC 1 equivalent.
- How long does a SOC 2 or SOC 1 audit take? Audit timelines vary by type (Type I vs. Type II), organization size, and readiness. A readiness assessment typically takes a few weeks whereas a Type I typically takes 3 months, and a Type II takes 6-15 months depending on the review period.
- What audits can BMSS conduct? We can conduct SOC 1 Type I, SOC 1 Type II, SOC 2 Type I, and SOC 2 Type II audits.
If you would like more information about SOC reports and what may be applicable for your company, please reach out to our SOC team by calling (833) CPA-BMSS or visit our website for more details.
