SOC Reports: The Difference between Type 1 and Type 2?
NOTE: Schellman recently updated this content to be more in-depth and address how an organization may choose its report type. You can find that information here.
There are two types of SOC 1 reports. The service organization is responsible for specifying whether or not a “Type 1” or “Type 2” will be performed.
A “Type 1” SOC 1 examination is performed when management requires a report on the fairness of presentation of the service organization’s internal controls over financial reporting and the suitability of the design of controls as of a specified date.
A “Type 2” SOC 1 examination is performed when management requires a report on the fairness of presentation of the service organization’s internal controls over financial reporting and the suitability of the design and operating effectiveness of controls over a period of time, typically six months.
About SCOTT ZELKO
Scott Zelko is a Managing Director at Schellman. Scott leads the Northeast Practice and the ISO Certification service line including ISO 27001, ISO 9001, ISO 20000, and ISO 22301. He works with many of the world’s leading cloud computing, FinTech, and security provider clients. Scott has more than 30 years of experience in the information technology field including IT management, system implementations, attestation and other advisory services and holds multiple certifications in the areas of Security, Privacy and Enterprise Governance. In addition, Scott works with clients to develop unified compliance strategies to meet internal, regulatory and client requirements.