A SOC 1 Type 2 report is an independent CPA firm’s examination of whether your organization’s internal controls over financial reporting were suitably designed and operated effectively across a defined review period, typically six to twelve months. Despite the common shorthand “SOC 1 certification,” this is an attestation engagement, not a certification. There is no pass/fail grade and no governing body issues the report. What you receive is a professional opinion, and the requirements to earn a clean one break down into scope, documentation, control operation, and time.
What the Report Actually Is
SOC 1 covers only controls that could affect a client’s internal control over financial reporting (ICFR). If your organization processes payroll, handles billing, administers retirement plans, or manages any transaction that eventually lands on a client’s financial statements, those are the controls in scope. General data security, privacy practices, and system availability outside the financial reporting context are not.
The governing professional standard is AT-C Section 320, which sits under the Statement on Standards for Attestation Engagements No. 18 (SSAE 18), published by the American Institute of Certified Public Accountants.1Wikipedia. SSAE No. 18 SSAE 18 replaced the older SAS 70 framework.2Journal of Accountancy. Replacing SAS 70
One requirement organizations frequently miss: the finished report is a restricted-use document. It is intended for your management, your user entities, and their auditors. You cannot publish it or hand it to prospects the way you would a marketing brochure. Distribution normally happens under an NDA or a controlled request process.
Type 1 vs. Type 2
A Type 1 report evaluates whether controls are properly designed and implemented as of a single date. A Type 2 tests whether those controls actually operated effectively over a continuous period, usually six to twelve months. Most clients and their auditors want the Type 2 because a well-designed control that nobody follows is worthless. Organizations pursuing their first SOC 1 sometimes start with a Type 1 to demonstrate that the framework exists, then move to Type 2 the following year once they have a track record of consistent operation.
SOC 1 or SOC 2
If your service directly touches a client’s financial statements (processing their transactions, calculating payroll, managing accounts receivable), SOC 1 is the right report. If your service stores, processes, or transmits sensitive data but does not directly feed financial reporting (cloud storage, SaaS platforms, managed IT services), SOC 2 is the better fit. It’s measured against the AICPA’s Trust Services Criteria covering security, availability, processing integrity, confidentiality, and privacy. Some organizations need both.
Controls the Audit Evaluates
The specific controls vary, but most SOC 1 Type 2 examinations center on IT General Controls (ITGCs) in four broad areas:
- Access management: who can reach systems that process financial data, how accounts are provisioned and revoked, password policies, privileged access, and physical security of data centers.
- Change management: how software and infrastructure changes are authorized, tested, approved, and deployed, with separation between the person requesting a change and the person approving it.
- System operations: monitoring, job scheduling, backups, and disaster recovery procedures.
- Governance: organizational structure, risk assessment, hiring practices such as background checks, and the policies forming the overall control environment.
Beyond ITGCs, the audit covers manual process-level controls specific to your service. If staff manually review and approve benefit disbursements before release, that review is a control, and the auditor will pull a sample to verify it happened during the testing window.
Documentation You Have to Produce
Most of the pre-audit effort goes into paperwork. Three items are non-negotiable:
- A system description narrating how client data enters your environment, how it’s processed, where it’s stored, and who interacts with it at each stage. This includes logical access policies, change management procedures, and physical security measures.
- A management assertion letter, a formal written statement from leadership confirming the system description is accurate and the controls are suitably designed and operating effectively.
- A control matrix tying each control activity to its corresponding control objective, identifying who performs the control, and describing the evidence each control generates.
You’ll also need to document Complementary User Entity Controls (CUECs), the controls you expect your clients to maintain on their end for the overall system to work. These appear in the final report so client auditors can confirm their side is in place.
Getting these documents organized before fieldwork begins reduces the time the auditor spends on site and the volume of follow-up requests.
The Timeline
A first-time SOC 1 Type 2 engagement typically takes six to fifteen months from initial planning to final report delivery:
- Pre-audit preparation, one to three months: defining scope, formalizing controls, producing the system description and control matrix. A readiness assessment sits here if you want one; it’s optional but useful when you know you have gaps.
- Observation period, six to twelve months: the window during which controls must operate continuously while you collect evidence. Six months is the typical minimum for a first Type 2; twelve months is standard for renewals and enterprise clients.
- Fieldwork, two to five weeks: the auditor samples transactions, events, and activities across the observation period and tests each control. Methods include inspection of evidence, direct observation, interviews, and re-performance of automated controls.
- Report drafting and delivery, two to six weeks.
The observation period is what makes the calendar feel long. You cannot compress a twelve-month window into six because a client needs the report sooner. The auditor is testing historical evidence across the full window, so controls need to have been running for that entire time.
What’s Inside the Report
The finished report follows a five-part structure:
- Section I, Auditor’s Opinion: the CPA firm states whether the system description is fairly presented, the controls were suitably designed, and they operated effectively during the review period.
- Section II, Management’s Assertion: leadership formally asserts the description is accurate and the controls are effective.
- Section III, System Description: the detailed narrative of infrastructure, software, people, procedures, and services.
- Section IV, Control Testing Results: the auditor’s procedures and findings for each control, including any exceptions.
- Section V, Complementary User Entity Controls: what clients are expected to maintain on their end.
The Four Possible Opinions
The auditor’s opinion is the single most consequential element of the report.
- Unqualified: the cleanest result. Description is fairly presented, controls are suitably designed, and they operated effectively throughout the period.
- Qualified: controls are effective except for specific areas identified in the report.
- Adverse: the auditor concludes user entities cannot place reliance on the system. Clients often reconsider the relationship after an adverse opinion.
- Disclaimer: the auditor could not form an opinion because access to information or procedures was restricted.
Even a clean report can contain individual control exceptions in Section IV. An exception means a specific control did not operate as described during one or more sampled instances. Design exceptions mean the control as written doesn’t achieve its objective; operating effectiveness exceptions mean it was properly designed but not consistently followed. A handful of operating exceptions won’t necessarily trigger a qualified opinion, but they get disclosed and client auditors will ask about them.
Subservice Organizations
If you outsource part of your service delivery to another vendor, the report must address how those outsourced controls are handled. Two methods are permitted:
- Carve-out method: the subservice organization’s controls are excluded from your report’s scope. The system description mentions the subservice organization and describes your monitoring of that vendor, but the subservice controls are not tested in your audit. This is the more common approach.
- Inclusive method: the subservice organization’s controls are included in your report. That vendor becomes part of the audit and must provide its own written management assertion. If they refuse, you must use carve-out instead.
Under the carve-out method you’re still expected to demonstrate active monitoring of the subservice provider, usually by obtaining and reviewing their own SOC report on a regular basis.
Bridge Letters and Annual Renewal
SOC 1 Type 2 reports go stale quickly. Once a year is the standard renewal cadence, and most clients and their auditors expect a fresh report annually. Even an annual cycle leaves a gap between the end of one period and the start of the next.
A bridge letter (sometimes called a gap letter) covers that interim, typically no more than three months. The service organization issues it on its own letterhead, not the auditor. It affirms that no material changes occurred to the control environment during the gap and that management is not aware of any control failures. A bridge letter is not a substitute for a full report, but it gives user auditors enough comfort to close out their own engagements while they wait for the next SOC 1.
Cost
Professional fees for a SOC 1 Type 2 examination generally run from $20,000 to $150,000, with a median around $30,000 for a straightforward engagement. A small payroll processor with one location and a handful of control objectives is a fundamentally different engagement than a multinational third-party administrator with complex systems and multiple data centers.
Factors that drive cost higher include the number of control objectives in scope, the complexity of the technology environment, the number of physical locations where controls are performed, and whether subservice organizations are involved. Type 2 also costs more than Type 1 because the auditor is testing months of evidence rather than evaluating a single date. Internal costs on top of the audit fee (staff time gathering evidence, coordinating with the auditor, and remediating issues found during fieldwork) are significant and often underestimated.