SOC 1 vs SOC 2: Which Report Your Customer Is Asking For

SOC 1 and SOC 2 answer different questions for different readers. A SOC 1 report covers the controls at your company that could affect a customer's financial statements, and it is read by that customer's financial auditors. A SOC 2 report covers how your system protects data against the AICPA's Trust Services Criteria, and it is read by security and procurement teams. If you touch your customers' money or books, expect SOC 1. If you hold their data, expect SOC 2. Some companies need both.

At a Glance

• SOC 1: controls relevant to user entities' internal control over financial reporting. You define the control objectives; the auditor judges whether they are reasonable and tests against them.
• SOC 2: controls relevant to security, availability, processing integrity, confidentiality or privacy, tested against the AICPA's Trust Services Criteria.
• SOC 3: the same examination as SOC 2, issued as a short general-use report you can publish.
• Both come in Type 1 and Type 2: Type 1 covers design at a date, Type 2 covers operation over a period.
• Who issues them: a licensed CPA firm, under the AICPA's attestation standards. They belong to the AICPA's SOC suite of services. SecureRoot prepares companies for the examination and does not issue reports.

What Each Report Is For

SOC stands for System and Organization Controls. The reports exist because companies outsource work, and whoever relies on an outsourced service needs assurance about it without auditing the provider themselves.

SOC 1 grew out of financial audit. When a company outsources payroll, its auditors still have to form a view on whether payroll is recorded correctly, and they cannot test the payroll provider's systems directly. The provider's SOC 1 report gives them what they need: a description of the system, the control objectives that matter to financial reporting, and an independent auditor's opinion on whether the controls achieve them.

SOC 2 answers a question SOC 1 was never designed for. A company handing its data to a cloud provider wants to know whether that data is secure, available and kept confidential, and none of that is about financial statements. SOC 2 measures the provider against a fixed set of criteria written for exactly that purpose.

SOC 1 vs SOC 2 vs SOC 3 Compared

The Real Difference: Who Sets the Yardstick

The practical difference is where the test comes from. In SOC 2 the criteria are fixed. Security has 33 criteria, every report includes them, and two SOC 2 reports can be read side by side. Our guide to the SOC 2 Trust Services Criteria sets out each category.

In SOC 1 there is no fixed list. Your management writes control objectives that fit your service: that transactions are authorised, processed completely and accurately, that changes to the application are approved, that access to financial data is restricted. A payroll processor's objectives look nothing like a fund administrator's. The auditor's job is to judge whether the objectives are reasonable for the service and whether your controls achieve them.

That has a consequence people miss. A SOC 1 report does include IT general controls, such as access, change management and operations, because financial data sits in systems. But it tests them only as far as they bear on financial reporting. A SOC 1 report is not evidence that a company's security is sound, and a security team that accepts one in place of a SOC 2 has accepted an answer to a different question.

Which One Do You Need?

Start from what your service does for the customer, not from what a competitor has.

1. Does your service process transactions or produce figures that end up in your customer's financial statements? Payroll, billing, payments, lending, claims and investment administration all do. That points to SOC 1.
2. Do you store, process or transmit customer data that is not about their financial reporting? Nearly every SaaS, hosting and IT services company does. That points to SOC 2.
3. Is the answer to both yes? Then both reports are likely to be asked for, by different people at the same customer.
4. Do you want something to publish? A SOC 3 report gives prospects a public summary without an NDA.

The table below is how this usually falls out for Indian service companies selling abroad.

If a customer's request simply says "SOC report", ask who is asking. A request from the finance team or the external auditors means SOC 1. A request in a security questionnaire means SOC 2.

When You Need Both

Needing both is less work than it sounds. The IT general controls a SOC 1 auditor tests, covering access, change management, backups and operations, are largely the same controls a SOC 2 auditor tests under the security criteria. One control set and one evidence trail can serve both examinations.

What differs is the layer on top. SOC 1 adds business process controls: reconciliations, approvals, input and output checks on the transactions themselves, which SOC 2 tests only when Processing Integrity is in scope. SOC 2 adds the governance, risk and vendor criteria that financial audits do not look at.

The efficient route is to use the same CPA firm for both, align the audit periods, and have the evidence collected once. Firms that issue both reports are used to shared testing, and the saving on your team's time is larger than the saving on fees.

Type 1 and Type 2 Apply to Both

The Type 1 and Type 2 distinction is separate from the SOC 1 and SOC 2 distinction, and both reports come in both types. A Type 1 report gives an opinion on whether the description of the system is fairly presented and the controls were suitably designed at a single date. A Type 2 report covers a period, usually three to twelve months, and adds an opinion on whether the controls operated effectively across it.

Financial auditors relying on a SOC 1 report almost always want Type 2, because they need assurance over the whole financial year. For SOC 2, a Type 1 is often accepted to unblock a first deal while the Type 2 period runs. Our comparison of SOC 2 Type 1 vs Type 2 covers how to sequence them.

The Standards Behind Each Report

Both reports are attestation engagements under the AICPA's Statements on Standards for Attestation Engagements. SOC 1 is performed under AT-C section 320, which deals specifically with controls at a service organisation relevant to user entities' financial reporting. SOC 2 is performed under the general examination sections, AT-C 105 and 205, using the Trust Services Criteria and the AICPA's SOC 2 guide.

Outside the United States the equivalents are international standards. ISAE 3402 is the counterpart of SOC 1, and European customers often ask for it by that name. In India, the Institute of Chartered Accountants of India has issued a corresponding standard, SAE 3402, for service organisation controls. There is no separate international standard for SOC 2; firms that issue it for non-US readers often report under ISAE 3000 as well as the AICPA standards, so one report serves both audiences.

For an Indian company, the practical point is that a customer asking for "ISAE 3402" and a customer asking for "SOC 1" want the same assurance, and a firm can frequently issue one report that satisfies both.

How SOC 2 Compares With ISO 27001

Buyers who ask about SOC 1 and SOC 2 often ask about ISO 27001 in the same conversation. ISO 27001 is a certification of your information security management system, issued by an accredited certification body, which SecureRoot is not, and it is the more common request from European and Asian customers. SOC 2 is an attestation report from a CPA firm and is the more common request from US customers. Neither replaces SOC 1. Our comparison of ISO 27001 vs SOC 2 covers which to start with.

What SecureRoot Does, and Does Not Do

SecureRoot prepares companies for SOC 2: scoping, gap assessment, control design, evidence collection and support through the audit, described on our SOC 2 service page. Our published range for that readiness work is Rs 1.5 lakh to Rs 4.5 lakh, with a Type 1 typically reached in eight to twelve weeks and a first Type 2 in six to nine months.

We are not a CPA firm. We do not issue SOC 1, SOC 2 or SOC 3 reports, and nobody who builds your controls should, because the auditor has to be independent. A licensed CPA firm issues the report and quotes its own fee.

Frequently Asked Questions

Is SOC 2 better than SOC 1?

Neither is better, because they are not two grades of the same thing. SOC 1 gives a customer's financial auditors assurance over the controls at your company that affect the customer's financial statements. SOC 2 gives a customer's security and procurement teams assurance over how your system protects data. A payroll processor with a SOC 2 report and no SOC 1 has not met its customers' audit needs, and a SaaS company with a SOC 1 and no SOC 2 will still fail a security questionnaire. The numbers are labels for different subject matter, not a ranking of one above the other. The right question is which reader you need to satisfy. If it is an auditor signing off financial statements, the answer is SOC 1. If it is a security reviewer deciding whether to trust you with data, the answer is SOC 2, and for some services it is both.

Can a company have both SOC 1 and SOC 2 reports?

Yes, and companies whose service is both financially significant and data-heavy commonly do: payment processors, payroll providers, lending platforms and healthcare claims processors among them. The two examinations overlap substantially in the IT general controls they test, including logical access, change management, backup and operations, so a single control set and a single body of evidence can support both. The differences sit above that base. SOC 1 adds controls over the business processes that produce financial figures, such as reconciliations and approvals. SOC 2 adds criteria on governance, risk assessment and vendor management. Using one CPA firm for both, with aligned audit periods, lets the firm test the shared controls once and rely on that work twice. The saving is mostly in your own team's time, because evidence is requested and gathered once rather than in two separate cycles.

What is SOC 3, and is it worth getting?

SOC 3 is a short, general-use report based on the same examination as a SOC 2. It contains the auditor's opinion and a summary of the system, and it leaves out the detailed description of tests and results that makes a SOC 2 report sensitive. Because it carries no restricted detail, you can post it on your website or hand it to a prospect without a non-disclosure agreement. It is worth getting when your sales team is asked for proof of security early and often, before a prospect is ready to sign an NDA, since it gives them something credible to forward internally. It is not a substitute for SOC 2. A security reviewer performing real due diligence will still ask for the full report, because the test results are what they read. Firms normally issue it as an add-on to a SOC 2 Type 2, drawn from the same fieldwork.

Is SOC 1 the same as ISAE 3402?

They are equivalents rather than the same document. SOC 1 is performed under the AICPA's attestation standards in the United States, specifically the section dealing with controls at a service organisation relevant to user entities' financial reporting. ISAE 3402 is the international standard covering the same subject, issued by the International Auditing and Assurance Standards Board, and it is the name European and many Asian customers use. The two were written to align, so the scope, the structure of the report and the Type 1 and Type 2 distinction all match. Many audit firms issue a single report stating that the examination was performed under both standards, which lets a service company with customers in several regions satisfy all of them with one engagement. If a customer asks for one and you hold the other, ask their auditors whether a combined report will be accepted. It usually is.

Which report do US customers ask Indian SaaS companies for?

Almost always SOC 2, and usually a Type 2. A US enterprise buying software from an Indian vendor is handing over data, so the request arrives through a security questionnaire or a vendor risk review, and the standard evidence that review looks for is a SOC 2 report covering at least the Security category. SOC 1 enters the picture only when the product processes transactions or produces figures that flow into the customer's financial statements, as billing, payments, payroll and lending platforms do. In that case the customer's finance team or external auditors will ask separately. ISO 27001 is sometimes accepted in place of SOC 2, more often by European buyers than American ones. Before starting either, read the contract clause or questionnaire item that prompted the request, because it normally names the report, the type and sometimes the categories the customer expects to see.

Where to Start

Find out who at your customer is asking and what they will do with the report. That single answer tells you which report, which type and which period. If the answer is SOC 2 and you want to know how far you are from it, request an assessment and we will scope it against your system.