A SOC 2 Type 1 report gives an independent auditor's opinion on whether a service organization's controls were suitably designed as of a single date. A SOC 2 Type 2 report adds testing of whether those controls actually operated effectively over a period, commonly six to twelve months. For vendors that matter to you, ask for Type 2.
The difference decides how much weight the report can carry in your due diligence. This post explains what each type covers, when a Type 1 is good enough, how to read a Type 2 properly, and where SOC 1 reports and bridge letters fit in.
What is a SOC 2 report?
SOC 2 is an attestation report defined by the AICPA. A service auditor (a licensed CPA firm) examines a service organization's system against the AICPA's Trust Services Criteria, which are grouped into five categories: security, availability, processing integrity, confidentiality and privacy.
Security, built on the common criteria, is included in every SOC 2 report. The other four categories are added when the service organization chooses to include them, usually because its customers ask. So a security-only report tells you nothing tested about availability, even for a service you cannot do without.
A SOC 2 report has three core parts: management's assertion, management's description of the system, and the service auditor's report with its opinion. A Type 2 report adds a fourth part, where most of the value lives: the auditor's tests of controls and their results. SOC 2 reports are intended for customers and their auditors and are usually shared under a nondisclosure agreement. A SOC 3 report covers the same criteria for general use but leaves out the test detail, so it is a weak substitute for due diligence.
What is the difference between SOC 2 Type 1 and Type 2?
A Type 1 report answers one question: on a specific date, were the described controls in place and designed well enough to meet the criteria?
A Type 2 report answers that question and a harder one: did the controls operate effectively throughout a defined period? The auditor samples evidence across the period, such as access approvals, change tickets and backup logs, and reports every deviation found.
| Point of comparison | SOC 2 Type 1 | SOC 2 Type 2 |
|---|---|---|
| What the opinion covers | System description and design of controls | Description, design and operating effectiveness |
| Time covered | A single date | A period, commonly 6 to 12 months (a first Type 2 is sometimes shorter) |
| Testing over time | None | Samples tested across the whole period |
| Exceptions reported | Not applicable | Yes, with management's response |
| Typical use | New service or first audit | Due diligence and periodic reassessment |
| Weight as evidence | Limited | Strong, when scope and period fit your use |
The period length is a market convention rather than a fixed rule, so read the dates on every report instead of assuming them.
When is a SOC 2 Type 1 acceptable?
A Type 1 is a reasonable starting point in a few situations:
- A new vendor or a new service. A company that has just launched a product often has a Type 1 while its first Type 2 period is running.
- A first audit. Many service organizations complete a Type 1 before they have enough operating history for a Type 2.
- A lower-risk relationship. Where the vendor holds little data and has no access to your systems, a Type 1, or no SOC report at all, may be proportionate.
How far you accept it should follow the vendor's tier. As an example of common practice, many programs accept a Type 1 for Tier 3 and Tier 4 vendors, accept it for Tier 2 vendors only with supporting evidence (a recent penetration test summary, key policies, a scoped questionnaire) and a dated commitment to a Type 2, and treat it at Tier 1 as interim evidence with a recorded risk decision and a follow-up date. Your own policy sets these rules; the risk-tiered due diligence whitepaper covers how to set evidence by tier.
How do you read a SOC 2 Type 2 report?
A clean opinion is where the review starts, not where it ends. Work through the same points every time and record your answers.
- Scope. Confirm the report covers the service you buy, the systems and locations behind it, and the categories you care about.
- Period. Note the start and end dates. If the period ended months ago, you need a bridge letter for the gap.
- Opinion. Check whether it is unmodified or qualified, and read any emphasis paragraphs.
- Exceptions. Read the test results even in an unmodified report. For each deviation, decide whether it touches controls relevant to your use and whether management's response is credible.
- Subservice organizations. Find the providers the vendor relies on, such as its cloud platform, and whether the report uses the inclusive or carve-out method. Carved-out providers are not tested, so material ones need their own evidence.
- CUECs. List the complementary user entity controls the report assumes you operate and map each to your own control.
How does SOC 1 differ from SOC 2, and what about bridge letters?
A SOC 1 report addresses controls relevant to customers' internal control over financial reporting. It is built for your financial statement auditors, and the control objectives are set by the service organization. Payroll processors, loan servicers and fund administrators typically provide one. A SOC 2 report addresses security and the other trust services categories. Some vendors need to give you both: a payroll processor holding personal data affects your financial reporting and your data protection.
Both share one timing problem: they cover a past date or period. When the period ended some time ago, ask the vendor for a bridge letter, a statement from its management covering the gap. Treat it as a management representation, not auditor assurance.
How VendRisk360 handles SOC report reviews
VendRisk360's SOC Report Review covers SOC 1 and SOC 2 reports, Type I or Type II, end to end: the period and bridge letters, scope against the services you use, the opinion, exceptions, subservice organizations and the carve-out method, and CUECs mapped to your own controls. A certified assessor performs the review, a second expert quality-reviews it, and you receive a written review report. AI assistance is optional.
Frequently asked questions
Is a SOC 2 Type 1 report enough for vendor due diligence?
It depends on the vendor's tier. A Type 1 shows controls were designed properly on one date but does not test whether they worked over time. Many programs accept it for lower-risk vendors, or for a new vendor with a Type 2 in progress, and ask critical and high-risk vendors for a Type 2 backed by other evidence.
How long is a SOC 2 Type 2 audit period?
There is no single fixed length. Periods of six to twelve months are common, and a service organization's first Type 2 report sometimes covers a shorter period, such as three months. Check the start and end dates on every report, because a short or old period gives you less assurance about how controls work today.
Which is better, SOC 1 or SOC 2?
Neither is better; they answer different questions. A SOC 1 report addresses controls relevant to your financial reporting and is designed for financial statement auditors. A SOC 2 report addresses security and, where included, availability, processing integrity, confidentiality and privacy. Ask for whichever matches the service, and both when the vendor affects financial reporting and holds sensitive data.
What should I do if a vendor's SOC 2 report shows exceptions?
Read each exception in the test results and decide whether it affects controls relevant to your use. Note management's response and whether the issue was fixed during or after the period. Raise relevant exceptions as findings with the vendor, ask for evidence of remediation, and record your conclusion on the vendor record.
About VendRisk360
VendRisk360 is an AI-assisted third-party risk management (TPRM) SaaS platform for regulated organizations. It keeps one governed record per vendor from intake to exit, assesses each vendor on evidence scaled to its risk tier, monitors vendors continuously from the outside (attack surface, data breaches, financial distress and adverse news), maps fourth and nth parties, and produces board-ready reporting. Teams run their program on the platform themselves, or turn on managed assessments and monitoring, delivered on the platform by VendRisk360’s certified reviewers. People make every decision.
This post is general guidance, not legal advice. Confirm your obligations with counsel and your supervisors.
