SOC 1 vs SOC 2: The Difference and Which Report You Need

System and Organization Controls (SOC) reports are issued by independent CPA firms under AICPA standards. The number names a different report, not a level: a SOC 2 is not an upgrade of a SOC 1. A SOC 1 report covers controls likely to be relevant to a customer’s internal control over financial reporting (ICFR). A SOC 2 report covers controls against the AICPA Trust Services Criteria (TSC) chosen for the engagement, such as security and availability. Which one you need depends on what your service does to the customer’s financial statements and who is asking:

• Your service feeds the customer’s financial statements (payroll, payments, claims, billing), or a controller or the customer’s financial statement auditor is asking: start with SOC 1.
• Customers want evidence about security, availability, processing integrity, confidentiality, or privacy, or a security, procurement, or vendor-risk team is asking: start with SOC 2.
• Both are true: both reports may apply, and neither replaces the other.
• You want a report anyone can read: that is SOC 3, the general-use summary of a SOC 2. A SOC 1 has no public version.

What is the difference between a SOC 1 and a SOC 2 report?

The AICPA’s SOC 1 overview names user entities and their financial statement auditors as the intended readers, and the AICPA’s SOC 1 guide covers examinations under AT-C section 320. The AT-C sections were first codified by SSAE No. 18, so a request for an “SSAE 18 report” does not by itself say which report is wanted. The CPA firm that performs either examination is the service auditor. The AICPA’s current Trust Services Criteria define SOC 2.

Outside the US, the counterpart to SOC 1 is ISAE 3402, the International Auditing and Assurance Standards Board’s standard for reports on controls at a service organization that are likely to be relevant to user entities’ internal control over financial reporting.

A customer asked for “a SOC report.” Which one do they mean?

Ask who will read it and what for. A request from the customer’s controller or financial statement auditor points to SOC 1. A request from its security, procurement, or vendor-risk team points to SOC 2. The words in the request are often the quickest clue:

Before you ask any CPA firm for a price, send the requester a short reply:

Before we scope this, can you confirm three things? First, who will read the report: your finance team or financial statement auditor, or your security or vendor-risk team? Second, which report and type you need: SOC 1 or SOC 2, Type 1 or Type 2. Third, what period it must cover, and for a SOC 2, which Trust Services Criteria beyond Security.

The answers give every firm you approach the same scope to price.

Do you need a SOC 1 if you already have a SOC 2?

You need a SOC 1 in addition to a SOC 2 when a customer’s financial statement auditor needs assurance over controls relevant to ICFR, because a SOC 2 opinion does not provide it. If no customer’s financial reporting depends on your service, you may not need a SOC 1 at all. A company can hold both reports, and some service organizations do; confirm each audience’s requirements before assuming one engagement covers both.

The same control can appear in both reports because a control can support different objectives in different engagements. An access review may be relevant to the integrity of a financial-processing application in a SOC 1 engagement and to unauthorized-access risk in a SOC 2 engagement. What matters is the objective, system boundary, evidence, and auditor’s testing, not the control name.

Some control activities may overlap, but a SOC 2 does not answer a SOC 1 request: the reports answer different questions and carry different opinions. Ask the auditor to map the overlapping activities to each report’s objectives. When the customer is a public company, our SOC 2 to SOX 404 bridge guide explains where SOC 2 evidence can support its SOX 404 review and where it cannot.

Is SOC 1 or SOC 2 required by law?

Neither report is a legal requirement in itself. The AICPA describes SOC reporting as a suite of service offerings CPAs may provide. A customer asks for a SOC 1 when your service can affect its financial reporting, and a SOC 2 request arrives through a contract, a security review, or a procurement checklist.

The legal duty sits with your customer. A public company’s auditor has to consider controls at the service organizations the company uses (PCAOB AS 2601), and a service auditor’s report is one way it gets that evidence. That audit runs on the customer’s fiscal year, so ask which year-end your report has to support. Our guide to SOC 2 Type 2 evidence in a SOX 404 ITGC review covers what that auditor can and cannot take from a SOC 2.

How do you choose between SOC 1, SOC 2, and SOC 3?

Choose by what your service does and who will read the report, not by which report sounds stronger. Neither SOC 1 nor SOC 2 is better than the other: the better report is the one the requester can use. Start from the service:

A SaaS company does not need a SOC 1 just because its customers are finance teams. Linford & Company, a CPA firm, places software on the SOC 1 side only when the platform calculates, records, or moves amounts that land in customers’ financial statements, and says one that only gives customers read access to their own data probably calls for SOC 2. SOC 2 does not establish HIPAA compliance by itself either: a healthcare service must assess its obligations under HIPAA and its business-associate arrangements; see HHS guidance on business associates.

Where does SOC 3 fit, and is it better than SOC 2?

SOC 3 is not better than SOC 2; it is the general-use version of the same subject matter, with less detail. The AICPA’s SOC 3 overview says SOC 3 reports address the same Trust Services Criteria as SOC 2 but do not provide the same level of detail, so they are general use reports that can be freely distributed. Companies use one to post on a security page or send to a prospect before an NDA is in place. Linford & Company, a CPA firm, notes that a SOC 3 always covers a period, like a Type 2, and has no Type 1 version.

SOC 3 sits on the SOC 2 side only. The AICPA names user entities and their financial statement auditors as a SOC 1 report’s intended readers, and no general-use report covers financial-reporting controls, so a SOC 1 has no public counterpart. A SOC 3 cannot answer a request for a SOC 1, and a security team doing a detailed vendor review may still ask for the SOC 2 itself. Neither report is a general security, privacy, or regulatory approval. SOC 2 vs SOC 3 report differences covers what a SOC 3 omits, whether it needs a SOC 2, and how to quote both.

Type 1, Type 2, or SOC 3: which version does the customer need?

That gives five reports a customer can mean:

The two Type 2 reports time their periods differently. A SOC 1 Type 2 speaks only to the months it covers, so set its period against your main customers’ fiscal years: months outside it have no auditor opinion behind them. A SOC 2 has no customer year-end to match, so the period is set around when buyers need a current report. For the international counterpart of SOC 1, ISAE 3402 says a Type 2 report ordinarily covers at least six months to be useful to user auditors (paragraph A30).

Get the customer’s requirement in writing: report family, type, criteria or control objectives, and the period it must cover. For the SOC 1 choice, the SOC 1 report guide charts the coverage gap and when a Type 1 is a sensible first report. For SOC 2, see the SOC 2 Type 1 vs Type 2 comparison. Can customers see my SOC 2 report? explains the NDA convention.

What does a SOC 1 report cover that a SOC 2 does not?

Payroll calculations, payment and claims processing, accounting services, and hosted applications that are part of a customer’s financial reporting process are the common cases. The customer’s financial statement auditor, the user auditor, decides how far its audit can rely on the report.

The label “FinTech” does not decide the report. A financial-technology company that only provides secure collaboration software may have a SOC 2 request. A less obviously financial vendor may need SOC 1 if its output feeds a customer’s financial statements. Ask the customer’s financial auditor or controller which process and control objectives they need addressed. Our SOC 1 report guide covers who needs one, what the report contains, Type 1 and Type 2 timing, and how to choose the CPA firm that issues it.

What does a SOC 2 report cover?

Use the SOC 2 Trust Services Criteria scope guide when you are deciding which optional categories match your customer promises. SOC 2 is an attestation report issued by an independent CPA firm, not a certification; “SOC 2 certified” is common marketing language, not the precise description. What Is SOC 2 Compliance? explains the terminology.

SOC 2 is not the AICPA’s SOC for Cybersecurity examination. The AICPA describes SOC for Cybersecurity as a CPA reporting on an organization’s enterprise-wide cybersecurity risk management program, and publishes a paper on the key distinctions between the two.

How do SOC 1 and SOC 2 compare on cost and timeline?

Both are priced by scope, not by report name, so two quotes for “a SOC 1” can describe different examinations. For SOC 2, our SOC 2 audit cost guide tracks the Type 2 quotes buyers receive and the fees firms publish, and how long a SOC 2 audit takes breaks the timeline into phases. We have no verified SOC 1 fee data, so we do not quote a SOC 1 range. Our SOC 1 audit firms page lists what drives a SOC 1 fee.

For a Type 2 of either report, the calendar has two parts: the period under examination, then fieldwork and reporting after it ends. Linford puts SOC 1 Type 2 fieldwork at four to eight weeks, separate from a period it says is usually twelve months. For a SOC 1, start from the customer’s year-end and work back, because the period has to cover the months its auditor relies on.

If you need both reports, ask one firm to coordinate them and to price each separately. Testing of shared controls such as access reviews and change management may serve both, but each report keeps its own scope, objectives or criteria, and opinion. Our page on whether one firm should handle both SOC 1 and SOC 2 lists what to ask. To find a firm for both, start with our SOC 1 audit firms: every firm on that list also audits SOC 2.

What should a buyer review in any SOC report?

The AICPA’s Key Elements of a SOC 2 Report video series covers the auditor’s opinion, management’s assertion, the system description, and the tests and results, and offers a SOC 2 report review checklist.

How can you tell which SOC report you are holding?

A file named “SOC report” or “SSAE 18 report” does not say which report it is, but the report does, in wording the AICPA standards require. Four checks separate SOC 1, SOC 2 and SOC 3. Read them in the service auditor’s report and management’s assertion.

Criteria and the restriction paragraph tell you the family. Control objectives and a restriction naming the auditors of the user entities’ financial statements mean SOC 1. Trust services criteria and a restriction naming parties with sufficient knowledge of the service mean SOC 2. Trust services criteria with no restriction and no tests mean SOC 3. For a SOC 1 or SOC 2, the fourth check then separates Type 1 from Type 2.

Read who the restriction names rather than whether one exists. The SOC 2 guide says nothing precludes the auditor from restricting a SOC 2 to a smaller group (paragraph 1.14), and a SOC 3 can carry a restriction when the auditor expects some readers to misunderstand it (paragraph 4.126).

The SOC 1 restriction is required wording. AT-C 320 says the report should carry it, and gives the reason: the criteria are relevant only to readers who understand how user entities use the system in their financial reporting (.A67). The AICPA’s SOC suite has no general-use counterpart to a SOC 1, the role a SOC 3 plays for a SOC 2. For the other elements a Type 2 SOC 1 must contain, see what the standard requires a Type 2 SOC 1 report to say.

Source: AICPA, AT-C section 320, paragraphs .40, .41 and .A67, in the AICPA’s AT-C sections 100 to 300 (2023 PDF, which notes June 2022 revisions), and the AICPA’s SOC 2 guide (October 2022 edition), paragraphs 1.10, 1.14, 1.73 to 1.75, 4.119, 4.120 and 4.126 and Appendix A, read October 21, 2026. Table cells paraphrase the standards. Appendix A describes itself as nonauthoritative and informational.

Once you know the report family, the criteria or ICFR objectives, and the report type, agree them with the requesting customer and the CPA firm. To compare firms that perform SOC 2 examinations, browse the SOC 2 auditor directory. For a SOC 1, our list of SOC 1 audit firms shows 87 of the 187 firms in the directory, each stating a SOC 1 offer on its own website. A firm not on the list may still offer SOC 1, so confirm before you ask for a SOC 1 proposal.