This blog specifically focuses on a SOC 2 examination and the differences between Type 1 and Type 2, as well as their practical implications. 

What is a SOC 2 examination?

Introduced originally in Statement on Auditing Standards No. 16, the objective of a SOC 2 examination is to provide service management, user entities, business partners, and other parties with information about controls at the service organization relevant to the security, availability, processing integrity, confidentiality or privacy criteria established by AICPA’s Assurance Services Executive Committee (ASEC) and set forth in TSP Section 100.

This information is used by the various entities to support their understanding of and to manage the risks that arise from their business relationships with service providers. The examinations result in the issuance of a Type 1 or Type 2 report by the service auditor.

What is the difference between a Type 1 and Type 2 examination?

A Type 1 examination reflects the service auditor’s opinion on the design of controls as of a specific date.

A Type 2 examination reflects the service auditor’s opinion on the design of controls AND the operating effectiveness of those controls over a specified period of time.

As suggested by the definition, a Type 2 report will carry more weight with user entities, business partners, and other parties as to the information about controls at the service organization. This is because the controls are being tested by the auditor over the specified period of time versus just a point-specific in time.

Which (Type 1 or Type 2) examination is appropriate for us? 

Which report is appropriate will generally be driven by a number of factors, some more critical than others, including:

• Who is driving the decision? Is it clients, potential clients? Internal stakeholders?

  Usually, we see companies embarking on the SOC 2 path because potential or existing clients are requiring them to do so.  Unfortunately, these parties do not always articulate whether they want a Type 1 or a Type 2.

  In the case of internal stakeholders, we often see this adopted as an initiative to eliminate being excluded from new customers as part of the sales vetting process they go through.

• Is this the first SOC 2 for the company?

  We sometimes get engaged with customers who at one time had SOC 2 examinations but have skipped a cycle and with customers who are embarking down the road for the first time.

  Our recommendation for SOC 2 “first timers” is start with the Type 1 with the commitment to roll into a Type 2 at a continuous cadence each year.  This allows you to build a baseline for an appropriate control structure and achieve some level of assurance that the controls are designed adequately.  A tangential benefit would be that you have a document that you can hand to potential customers that might satisfy their vetting exercise.

  For previous “SOC 2ers”, if your business processes and infrastructure have not changed drastically since the last report, our recommendation is to get the Type 2 (assuming the previous reports contained “clean” opinions), regardless of whether you had a Type 1 or Type 2 in the past.  If you can honestly say that things have not changed and that the controls are still functioning as designed, get back on the Type 2 horse and STAY ON IT.

• Have you had exams previously under different compliance frameworks? Have you undergone a SOC 2 assessment previously?

  There is considerable overlap amongst compliance frameworks (which drives organizations crazy sometimes).  Chances are if you are ISO 27001 certified or experienced with HITRUST, COBIT and other frameworks, you are well on your way to achieving SOC 2 compliance (Security Criteria) and our recommendation is for a Type 2 examination. 

  The AICPA, ISACA and other organizations have mapping tools that can assist you in your assessment.

  If you have undergone a SOC 2 assessment and related remediation activities, you should consider having the Type 1 performed and issued and then roll into the Type 2 cadence for future periods.

To summarize, if you are a first timer to the process, we recommend the Type 1 examination unless mandated otherwise by the interested parties.  However, you should really only have a Type 1 examination for that initial offering or if circumstances (infrastructure, etc.) change significantly.

Other Considerations

From an overall SOC 2 perspective, consider the following as part of your planning

Type 2 examination period length

SOC 2 examinations are different from SOC 1 examinations (one time known as SAS 70, et.al.) because of their different objectives.  The purpose of a SOC 1 is to provide management of the service organization, user entities, and the independent auditors of user entities’ financial statements with information and a services auditor’s opinion about controls at a service organization that are likely to be relevant to user entities’ internal control over financial reporting.

Unfortunately, these reports are often mixed up – even by CPAs!  SOC 2s have no definitive examination period requirement – SOC 1s should be at least a six-month examination period.  As a result, we have seen organizations approached by the users of SOC 2 reports that are less than a six-month time frame and challenged by its legitimacy.

A wise person once said “you can’t fight city hall” – therefore we recommend that your report include a minimum six-month examination period to reduce the likelihood of user pushback.

GRC tools do not automatically equate to SOC 2 compliance

Numerous Governance Risk & Compliance (“GRC”) tools advertise that they will make your SOC 2 compliance easier, reduce the cost of SOC 2 compliance and the length of time that is required by the auditor in performing the SOC 2 examination.

Although GRC tools can definitely help with compliance, you should not purchase those tools simply to facilitate compliance examinations.  You should implement these tools first and foremost as part of your compliance program. 

Also, GRC tools assist in the SOC 2 audit by allowing you to organize your data and internal compliance testing results for the auditor – but they do not necessarily reduce the level of effort required by the auditor to adhere to professional standards relative to the performance of a SOC 2 examination.

Selecting the appropriate category and type of SOC report can be challenging.  Please feel free to  reach out to a member of our Information Security Services Team to schedule a quick scoping call to plan your path.