SOC 2 Type 1 vs Type 2: Cost, Differences & Choice

Default: ask the requester which report they accept, in writing. If a named buyer accepts Type 1 and you cannot cover a Type 2 period before their deadline, take Type 1 and start the Type 2 period as soon as your controls are operating. If the request names Type 2, or the requester will not confirm that Type 1 is enough, go straight to Type 2. You do not need a Type 1 first. Some firms include one in the Type 2 fee, so ask what it adds.

This page compares SOC 2 Type 1 and Type 2 only. For SOC 1 (controls relevant to a customer’s financial reporting) against SOC 2 (the Trust Services Criteria), use SOC 1 vs SOC 2. For SOC 1 Type 1 and Type 2, including how the period should line up with a customer’s fiscal year, see the SOC 1 report guide.

SOC 2 Type 1 vs Type 2 at a glance

Both reports examine controls relevant to the selected Trust Services Criteria. The difference is the span the opinion covers and whether the auditor tests that the controls operated.

Timing rows are planning ranges from our SOC 2 audit timeline guide, counted from the day controls are ready and excluding readiness work. Your fee depends on the firm and scope as well as the report type; the cost section below charts directory fee bands by firm type, which are medians for attestation-capable firms and not quotes, and shows how much a Type 1-first path adds.

Type 2 is also written as Type II. The two labels mean the same report type. Type 1 may likewise appear as Type I.

Do you need Type 1 before Type 2?

No. You do not have to complete a Type 1 before a Type 2, and you can start a Type 2 period as soon as your controls are operating and you can keep the evidence.

Take a Type 1 first when a named requester accepts it now and you cannot cover a Type 2 period before their deadline, or when management wants an independent examination of control design before building a longer operating record. Ask the firm what it adds to the bill. Where one fee covers both reports, a Type 1 is usually worth the extra round of fieldwork, for a dated opinion on your design and a report to share sooner. A readiness review also checks design before the period starts, but it produces no report. The cost section puts a multiple on the separate-fee path.

What does the auditor do differently in Type 1 and Type 2?

The auditor examines the same controls in both; Type 2 adds testing of how they operated across the period. Calling Type 2 a point-in-time snapshot reverses the distinction: Type 1 is the dated one. Type 1 is not “no testing” either: the CPA still examines whether the described controls are suitably designed as of that date. A panelist at AICPA & CIMA’s 2023 SOC conference put it this way: “For a type 1, the service auditor is evaluating controls as of a specific date” (AICPA & CIMA summary).

An illustration, not an observed engagement: take a quarterly access review. In a Type 1, the auditor looks at whether the control is designed to catch inappropriate access, such as a written procedure, a named reviewer, and the systems the review covers, as of the report date. In a Type 2 covering twelve months, the review should have run four times. The auditor tests those occurrences, for example whether each review was completed, who approved it, and whether the access changes it found were made. A skipped or late review shows up as an exception in the report. The firm chooses its own procedures and sample sizes.

That difference sets the evidence your team keeps. For Type 1, an auditor might inspect a current access-control policy and the system configuration. For Type 2, the auditor also needs records showing the control operated during the period, such as completed access reviews, approved change records, security training records, or incident-response activity.

The period is stated in the report and agreed with the CPA firm. The AICPA does not publish a universal minimum period, so three, six, and twelve months are common planning windows, not prescribed tiers. A short first period can leave a quarterly or annual control with few or no occurrences to test, which is one reason the firm must approve the dates. Our SOC 2 observation period guide explains how to choose the window.

Type 2 vs Type 1: which do customers accept?

It depends on the requester, so the written request decides. Drata’s help center says most customers and prospects familiar with SOC 2 ask for a Type 2 (Drata). Our 2026 analysis of more than 500 RFPs and buyer interviews points the same way: approximately 98% of Fortune 500 buyers and 85% of mid-market buyers require a Type 2 report. Two published benchmarks count the reports themselves. Lazarus Alliance, a CPA firm, reports that 73% of the 75 SOC 2 examinations it completed between January 2025 and June 2026 were Type 2 (2026 SOC 2 benchmark). In CBIZ’s 2024 benchmark of 193 SOC 1 and SOC 2 reports, 5.2% were Type 1 (CBIZ). Both count reports that were issued, not what any one requester accepts. A Type 1 is enough only when your requester says so.

A reviewer reading a Type 1 learns that the controls were suitably designed on one date. Nothing in it shows whether they ran afterwards. A reviewer reading a Type 2 sees the auditor’s tests across the period and any exceptions. That is why a requester who accepts a Type 1 may still want to know a Type 2 is coming. Ask whether a Type 1 plus a written commitment to a Type 2, such as an engagement letter with your CPA firm, would satisfy them.

Before you buy either report:

1. Get the requirement in writing. Ask whether the requester accepts Type 1, expects Type 2, or requires a particular coverage period.
2. Confirm what the deadline means. A signed engagement letter, completed readiness work, and an issued SOC 2 report are different milestones.

How much do Type 1 and Type 2 audits cost?

A firm’s Type 2 usually costs more than its own Type 1, by a multiple that varies from firm to firm. A buyer receives quotes from individual firms, so the useful comparison is one firm’s Type 2 price against its own Type 1 price.

Assurance specialist, Type 1

$10K–$24K

Assurance specialist, Type 2

$15K–$45K

Full-service CPA, Type 1

$15K–$38K

Full-service CPA, Type 2

$25K–$60K

Big Four, Type 1

$40K–$145K

Big Four, Type 2

$65K–$200K

$0$50K$100K$150K$200K

Of the listed firms, 2 charge one fee that covers both reports, so a Type 1 first adds nothing to their price. Across the other 185 directory listings that show both a Type 1 and a Type 2 minimum, the median Type 2 minimum is 1.6 times the Type 1 minimum. At that ratio, a Type 1 followed by a Type 2 costs about 64% more than going straight to a Type 2 at the minimum, before any discount or credit a firm gives for doing both. Among the 7 listings where the firm confirmed its fees or published them, the ratio runs from 1.0 to 1.7. The remaining figures are planning estimates, mostly ours, so use the ratio to plan and ask each auditor to price both paths.

In Q3 2026, firms quoted companies with up to 50 employees a median $9,000 for a SOC 2 Type 2 audit through SOC2Auditors.org, in ballpark quotes before scoping.

Our quote data covers Type 2 audits only, so there is no observed Type 1 price to compare. Ballpark quotes vary with company size. The audit cost guide shows them by size band and sets out the Type 2 premium over Type 1.

A credit toward the Type 2 is the firm’s choice. Some firms may reuse knowledge or evidence, but commercial terms vary, so get the whole path priced in writing if you expect to complete both. That route is two fieldwork windows and two reports. At a full separate fee, take it only when a named recipient will accept Type 1 now and a Type 2 period cannot finish before their deadline.

The final fee depends on the system scope, selected Trust Services Criteria, number of controls, organizational complexity, locations, subcontractors, evidence quality, and auditor. Read each proposal closely. A low headline fee may exclude readiness support, penetration testing, extra remediation rounds, or work added after the scope changes.

For a first-year budget by company size, use the SOC 2 audit cost guide. The SOC 2 renewal cost guide covers year two. You can compare firms in the SOC 2 Type 1 auditor directory and SOC 2 Type 2 auditor directory.

When should you choose SOC 2 Type 1?

Choose Type 1 when a named customer or other stakeholder explicitly accepts it and a report at a specified date solves the immediate requirement. It can also be useful when controls are newly implemented and management wants an independent examination of their design before building a longer operating record.

If Type 2 is likely to follow, scope it now. Design evidence collection and control ownership for ongoing operation from the start, so the Type 1 controls carry into the period without rework.

When should you choose SOC 2 Type 2?

Choose Type 2 when the requester needs evidence that controls operated effectively over time, not only that they were designed at one date. This is often the more useful destination for recurring vendor reviews because the report contains testing across a defined period.

Go directly to Type 2 when all three conditions are true:

• The party asking for SOC 2 requires Type 2 or will not confirm that Type 1 is acceptable.
• Your controls are operating and your team can preserve evidence consistently.
• The expected report date leaves enough time for the agreed period, auditor fieldwork, management responses, and report issuance.

For more detail on the report itself, read what a SOC 2 Type 2 report contains. For the full Type 2 process, from readiness to fieldwork, see the SOC 2 audit timeline.

What if the RFP already requires Type 2?

If the written request names Type 2, do not buy Type 1 as a substitute. A Type 1 report will not satisfy a Type 2 requirement, even if it arrives sooner.

You then have two options:

1. Start the Type 2 period now if controls are operating and you can retain evidence. Agree the start date, the period, and the expected issuance date with the CPA firm before fieldwork.
2. Tell the requester the coverage you can actually deliver if controls are too new. A Type 1 may still help only when they confirm in writing that they will accept it as an interim. Otherwise wait, run the period, and issue Type 2.

A shorter Type 2 period is a negotiation with the CPA firm and the report users, not a way around operating-effectiveness testing. The observation period guide covers 3-, 6-, and 12-month planning windows.

How to make the final choice

Start with the external requirement, then test it against operational readiness and budget.

Before signing, send the auditor your system description, desired criteria, target report date, customer wording, and any known scope changes. Request a written fee breakdown and confirm the exact date or period the opinion will cover. To compare firms first, browse the SOC 2 auditor directory. For where this choice sits in a full audit, see our SOC 2 compliance guide.