SOC 2

A practical choice between design at a date and operating effectiveness over a period, with buyer, timing, and evidence questions to settle first.

Explore SOC 2 advisory

What does each report answer?

A SOC 2 Type 1 report addresses the description of a service organization's system and whether the controls were suitably designed as of a specified date. A Type 2 report adds the independent CPA's opinion on whether those controls operated effectively over a specified period, with tests and results. Neither is a general certificate for every product, entity, or location. Both must be read against the services and Trust Services Criteria included in the engagement.

For a buyer assessing a provider's control operation, the difference is material. A Type 1 opinion can show that a control design existed at a date. It cannot, by itself, show a history of access reviews, releases, incident handling, or supplier checks working as intended. A Type 2 report is structured to address that operating history. If a procurement team expressly requires Type 2, offering Type 1 as an equivalent is likely to leave the question unanswered.

Choose from the buyer request backward

Collect the exact request before selecting a path. Ask which product is being purchased, which company will sign the contract, whether the buyer expects Security alone or other criteria, and whether it needs a particular report period. A European, Australian, or Singapore-based provider may receive the same SOC 2 request from an overseas customer; the provider's location does not change what the report actually covers.

A Type 1 engagement can be a useful milestone when control design is in place but a period of operation has not yet elapsed. It is not automatically a required first step. Discuss the intended users, report type, criteria, system boundary, and timing with an independent CPA firm before committing to a delivery date. If there is already a functioning control operation, a direct Type 2 path may better answer the buyer's request.

Plan the Type 2 period around real operation

There is no universal SOC 2 rule that every Type 2 report must cover a fixed number of months. The reporting period must let the CPA form an opinion on operating effectiveness and be useful to intended readers. Agree the period with the CPA firm and check the customer's procurement expectation. Avoid treating a short reporting period as a marketing shortcut if it does not show enough examples of periodic controls or the service's normal activity.

Before the period starts, name control owners and identify the full population of events each control is expected to cover. For example, a monthly access review needs a review record for each scheduled month; a change control needs evidence for the production changes within scope. A blank month, missing approval, or unreviewed exception should be investigated when it occurs. A later policy edit cannot recreate historical performance.

Use a decision record, not a label

Write one page recording the buyer's request, selected service boundary, selected criteria, proposed report type, target period, and dependencies on subservice organizations. Add the independent CPA firm's feedback and any gap between what the first report can address and what the buyer asked to see. This prevents the sales team from describing a Type 1 report as proof of operating effectiveness or implying that one SOC 2 report covers the entire business.

If the provider also has ISO/IEC 27001 certification, check that certificate's scope separately. An ISMS certificate and a SOC 2 report can reinforce a buyer's understanding of governance, but their boundaries and conclusions are different.

Put it into practice

  • Ask the buyer which service, criteria, report type, and period it expects.
  • Decide whether control design is ready for a dated opinion or operation is ready for period testing.
  • Agree the Type 2 period and evidence expectations with an independent CPA firm.
  • Record the scope and any gap between the report and the buyer request.

Primary sources

Normstone resources are general information, not legal advice or an independent assessment.

All resources