.png)
When a customer asks for “an audit,” the right SOC report can satisfy the request without overspending. Here’s how SOC 1, SOC 2, Type 1, and Type 2 reports differ.
Sooner or later, most service organizations get the email: a customer wants proof that your controls work. Often the request simply says “audit,” which leaves you guessing.
We recently walked through that confusion in a Health Care Administrators Association (HCAA) webinar, From Audit Basics to Vendor Due Diligence: What Every Organization Should Know. Our first tip: when someone asks for an audit, ask what they need assurance over.
What Is A SOC Report?
A System and Organization Controls (SOC) report is an independent CPA firm’s opinion on the internal controls at a service organization, meaning a company that performs services for other companies. The American Institute of Certified Public Accountants (AICPA) sets the standards for the SOC suite of services.
The two most common types are:
- SOC 1: focused on financial reporting controls
- SOC 2: focused on data security and related criteria
Like any audit, a SOC examination provides reasonable assurance based on sample testing, not absolute assurance.
What Is A SOC 1 Audit?
A SOC 1 audit examines a service organization’s controls that are likely to be relevant to its customers’ internal control over financial reporting (ICFR). In short, do your customers rely on you for numbers that end up in their financial statements?
Healthcare third-party administrators (TPAs) are a classic example. TPAs collect premiums, pay providers, and manage funds for self-funded employers. That work directly affects claims expenses and reserves on their customers’ books. SOC 1 reports are restricted to use, meant for customers and their auditors rather than the public.
SOC 1 Type 1 vs. Type 2: What’s The Difference?
Both SOC 1 and SOC 2 reports come in two types:
- Type 1 tests whether controls are suitably designed and in place as of a single date, such as Sept. 30.
- Type 2 tests design and operating effectiveness over a period, typically 12 months.
A Type 2 shows controls working throughout the period, so it provides stronger assurance and is what most customers request. We often suggest Type 1 as a first step.
When Does A SOC 2 Make More Sense?
A SOC 2 evaluates controls against the AICPA’s trust services criteria: security (always included), availability, processing integrity, confidentiality, and privacy. It fits vendors that store or process sensitive data, such as claims processing software providers.
Related options can save time and money:
- SOC 3: a shareable summary of a SOC 2 Type 2 report.
- SOC 2+: adds frameworks such as the HIPAA Security Rule to the same engagement.
We’ve also worked with clients whose customers asked for a SOC 2 and were satisfied once we added IT controls to an existing SOC 1.
What Does The SOC Reporting Process Look Like?
For a first-year engagement, we typically see three phases:
- Readiness (up to about three months): We help define your controls and identify gaps. Remediation, such as strengthening authentication, often takes the longest.
- Testing (usually one to two months): We collect evidence that each control operates as described.
- Report delivery: You share the report with the customers or regulators who requested it.
Most SOC reports disclose a few minor exceptions, each with a written management response providing more context. That’s very normal and usually more of an indicator of a quality audit than something to worry about. Of course, the nature of the exceptions matters more than how many there are.
Before You Commit, Ask The Right Questions
Confirm what your customer actually needs. If a customer brings in $5,000 a year, a $30,000 audit may not make sense. Sometimes a different report will do, or the customer helps share the cost. Some of our first conversations with organizations end with advice on how to go back to the customer rather than with an engagement. We’re fine with that.
Learn how an independent rate review helped a utility reseller build customer trust.
Get The Right SOC Report The First Time
Choosing between a SOC 1 and SOC 2, or Type 1 and Type 2, is easier for someone who performs these audits every day. Our SOC Reporting team can help you:
- Clarify what your customer is asking for
- Prepare through a readiness assessment
- Deliver a report your customers can rely on
Talk to an expert about your SOC reporting needs.
Frequently Asked Questions
Do you need a SOC report every year?
Usually, it depends on your customers. Type 2 reports typically cover 12 months and repeat annually. SOC reports are driven by customers rather than required by law, so some organizations issue one every other year.
Can a small organization get a SOC 2?
Yes. SOC controls are designed around each organization’s risks rather than a fixed checklist, so they can be tailored to a team with only one or two IT staff. Basics like segregation of duties still apply.
How much does a SOC audit cost?
Costs depend on scope, size, and provider. Across reputable firms nationally, SOC 1 and SOC 2 engagements generally range from about $20,000 to $60,000.
