Start for free Start for free

SOC 1 vs SOC 2

A SOC 1 report covers a vendor's controls that can affect your financial reporting, such as payroll or billing processing. A SOC 2 report covers controls for security, availability, processing integrity, confidentiality and privacy. For most SaaS tools, SOC 2 is the one to ask for.

The short answer

Both are audit reports on a service provider, written by a CPA firm under AICPA standards. They answer different questions.

SOC 1 asks: can this vendor's work throw off your financial statements? SOC 2 asks: does this vendor keep your data and systems secure and available?

SOC 1

  • What it covers: controls at a service organization "likely to be relevant to user entities' internal control over financial reporting" (AICPA & CIMA). In plain words: anything the vendor does that feeds numbers into your books.
  • Who uses it: its use is restricted to the vendor's management, its customers and those customers' auditors (Journal of Accountancy). Your financial auditor is the main reader.
  • Typical vendors: payroll providers, payment processors, billing and invoicing platforms, expense tools and other services that process transactions for you.

SOC 2

  • What it covers: controls related to security, availability, processing integrity, confidentiality or privacy, measured against the "trust services criteria" (Journal of Accountancy).
  • Who uses it: security, IT and compliance teams reviewing a vendor. Its use is also generally restricted, so you request it from the vendor.
  • Typical vendors: SaaS tools that store or handle your data.

Both come in two types. A Type 1 checks control design on one date, and a Type 2 also tests whether the controls worked over a period. See SOC 2 Type 1 vs Type 2. A SOC 3 covers the same ground as SOC 2 in less detail and is not restricted, so vendors can post it publicly.

Which one applies to you

  • For most SaaS vendors: ask for SOC 2. It is the report that speaks to how your data is protected.
  • For vendors that touch your money or books: ask for SOC 1 as well, if your financial auditor needs it. A payroll or payments vendor may have both.
  • If you are audited: ask your auditor which vendors they want SOC 1 reports for. They may also want a bridge letter if the report period does not line up with your fiscal year.
  • Do not swap them: a SOC 1 does not tell you much about data security, and a SOC 2 does not tell your auditor about financial controls.

If a vendor sends a SOC 2 when your auditor asked for a SOC 1, or the other way around, go back and ask for the right one rather than filing what you got.

In either report, read the section listing complementary user entity controls. These are the controls the vendor expects you to run on your side, such as reviewing who has access or checking reports the system produces.

Example

For example, imagine you use a billing platform that calculates invoices and records revenue for you. Your financial auditor asks for its SOC 1 Type 2, because errors there would flow into your revenue numbers. Your security lead asks for its SOC 2 Type 2, because the platform stores customer contact and payment details. Both requests are reasonable, and they go to different readers. Keep each report with the vendor's file so you can find it at audit time and at renewal.

Before you file either report, check three things: the name of the system covered, the dates of the review period, and any exceptions the auditor reported. In a Type 2, the tests and results section shows where a control did not work as described, so read that part closely.

Reports also have limits in time. A SOC report looks back at a period, while the vendor's terms keep changing. Venpo has written about the hidden risk of vendor legal changes between reviews.

How Venpo helps

SOC reports tell you how a vendor's controls looked during the audit period. Venpo monitors your vendors' public legal pages, including trust centers, DPAs, subprocessor lists and billing terms, and emails a plain-English alert when they change after the report was written.

Start for free

Frequently asked questions

Is SOC 1 or SOC 2 better?

Neither is better, because they cover different things. SOC 1 is about controls that affect financial reporting, and SOC 2 is about security and related controls.

Do I need a SOC 1 report from my SaaS vendors?

Only for vendors whose work affects your financial statements, and usually only if your auditor asks for it. For most SaaS tools, a SOC 2 is the report to request.

What is the difference between SOC 2 and SOC 3?

A SOC 3 covers the same subject as a SOC 2 but leaves out the detailed test results. Because its use is not restricted, a vendor can post it publicly.

Related terms

Security and Compliance SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. Security and Compliance SOC 3 Report A SOC 3 report is a short, public summary of a vendor's SOC 2 audit. It shows the auditor's overall opinion but leaves out the controls tested and the detailed results, so it cannot replace the full SOC 2 report. Comparisons SOC 2 Type 1 vs Type 2 A SOC 2 Type 1 report checks whether a vendor's security controls are well designed on a single date. A Type 2 report also tests whether those controls actually worked over a period of months, which makes it stronger evidence. Security and Compliance Complementary User Entity Controls (CUECs) Complementary user entity controls (CUECs) are the security steps a vendor's SOC report assumes you, the customer, will take. The vendor's controls only work as described if you do your part, such as managing your own users' access. Security and Compliance Bridge Letter A bridge letter is a short letter from a vendor's management covering the gap between the end of its last SOC report period and today. It says no material control changes are known, but no auditor has checked it.

Sources

Last reviewed