SOC 1 vs SOC 2, Type 1 vs Type 2: What a User Auditor Can Actually Rely On

Search for the difference between SOC 1 and SOC 2 and every result is written by a company that sells SOC 2 audits to software vendors. Their question is which report a customer will ask for. The auditor's question is different, and it is the one AUD examines: a client in Riyadh outsources its payroll, its inventory system or its entire ERP to a service organization, and the auditor has to decide what a report from that organization's own auditor lets them rely on, and what they still have to do themselves.

The answer has three parts. Only a SOC 1 report speaks to controls over financial reporting. Only a Type 2 report speaks to whether those controls operated over a period. And even a SOC 1 Type 2 leaves the user auditor with work: the controls the report assumes the client itself performs, the gap between the report's period and the audit's, and the judgement about whether the service auditor can be trusted. The standard is AU-C 402 for the user auditor and AT-C 320 for the service auditor; the ISA and ISAE equivalents, ISA 402 and ISAE 3402, are the ones SOCPA endorses.

The reports

	SOC 1	SOC 2	SOC 3
Subject	Controls at the service organization relevant to user entities' internal control over financial reporting	Controls relevant to security, availability, processing integrity, confidentiality and privacy	Same as SOC 2
Criteria	The service organization's own control objectives	The AICPA Trust Services Criteria	Trust Services Criteria
Intended users	User entities' management and user auditors	Management, customers, regulators, business partners with sufficient knowledge	Anyone; a general-use summary with no detail
Standard for the service auditor	AT-C 320	AT-C 105 and 205	AT-C 105 and 205
Use in a financial statement audit	Yes: this is what AU-C 402 contemplates	Not for reliance on financial reporting controls; may inform IT risk assessment	No

The first row is the whole distinction. A SOC 1 report exists so that a user auditor can understand and, where appropriate, rely on controls at a service organization that affect the user entity's financial statements: the payroll processor's controls over calculating pay, the custodian's controls over recording securities, the cloud ERP vendor's controls over program changes. A SOC 2 report exists so that a customer can assess whether its data is secure and its service available. Both are attestation reports issued by CPAs, both can be Type 1 or Type 2, and only one of them is about the numbers.

A SOC 2 report is not useless to the financial statement auditor. Where the user entity's financial reporting depends on the security and availability of a system, the SOC 2 report is evidence about the IT general environment, and it can inform the risk assessment. What it cannot do is substitute for tests of the controls that process the transactions, because it was not designed to test them.

Type 1 and Type 2

	Type 1	Type 2
What the service auditor opines on	Whether the description of the system is fair and the controls are suitably designed and implemented, at a point in time	The same, plus whether the controls operated effectively over a period
Contains tests of controls and results	No	Yes, for each control objective
Supports the user auditor's understanding of controls	Yes	Yes
Supports reduced substantive testing by the user auditor	No; design alone says nothing about operation	Yes, for the period covered

A Type 1 report answers the question the user auditor asks at the understanding stage: what does the service organization do, and are its controls designed to do it? A Type 2 report answers the question asked at the testing stage: did they work? An auditor who reduces substantive procedures on the strength of a Type 1 report has assessed control risk below the maximum on evidence about design only, which AU-C 402 does not permit. That sentence, in some form, is the most reliable AUD question on the topic.

What the user auditor does

AU-C 402 lays out a sequence, and each step is examinable.

1. Understand the services and their effect. The user auditor identifies which services the service organization provides, how material they are to the financial statements, the degree of interaction, and the nature of the transactions processed. A firm that hosts the client's email is not a service organization for this purpose; a firm that runs the client's payroll is.
2. Decide whether reliance is needed. If the user auditor can obtain sufficient evidence by substantive procedures at the user entity, for example by recomputing the payroll from source data, no control reliance is needed and the report is used only for understanding. Reliance is a choice, not an obligation.
3. If relying, obtain a Type 2 report or perform tests of controls at the service organization, directly or through another auditor.
4. Evaluate the service auditor. Professional competence, and independence from the service organization, under standards the user auditor considers adequate. The report of a service auditor the user auditor cannot satisfy themselves about is not evidence.
5. Evaluate the report. Does its period cover enough of the audit period? Are the control objectives the ones the user auditor cares about? Were there deviations, and what do they mean for the user entity's transactions? Does the report carve out or include subservice organizations the client also depends on?
6. Test complementary user entity controls. Every SOC 1 report lists controls the service organization assumes user entities perform themselves, such as reviewing exception reports or authorising input. The service auditor did not test those; the user auditor has to, at the client.

Two of those steps carry most of the marks. The period gap: a Type 2 report covering January to September, used in a December year-end audit, leaves three months uncovered, and the user auditor asks the service organization for a bridge letter confirming no significant changes, and considers whether further procedures are needed. The complementary user entity controls: a payroll processor's control over pay rates assumes the client authorised the rates it sent, and if the client did not, the processor's clean report is worthless for that assertion.

What the report cannot do

The user auditor's report is the user auditor's. AU-C 402 prohibits referring to the service auditor's work in the user auditor's opinion as a basis for it; the user auditor takes full responsibility, and a modified opinion cannot be explained by pointing at the service auditor. The service auditor's report is restricted to the service organization's management, user entities and user auditors, and the user auditor cannot pass it on to third parties. And the report is as of its own date and period: a change in the service organization's system after the report, which the bridge letter is meant to surface, is not covered.

The Saudi frame

The same structure applies under the ISAs. ISA 402 is the user auditor's standard and ISAE 3402 the service auditor's, and a Saudi listed company's auditor working under SOCPA's endorsed standards asks the same questions of the same reports; a SOC 1 issued by a US firm under AT-C 320 and an ISAE 3402 report issued by a Saudi firm are the same kind of evidence. Where a Riyadh client runs its ERP on a global cloud provider, the report the auditor receives will usually be a SOC 1 in AICPA form, and the analysis above is exactly what the SOCPA Audit paper expects too. The Saudi layer of the profession, what SOCPA licenses and what the CMA registers, is in the SOCPA Audit study guide.

How AUD asks

Question pattern	Answer
"Which report is designed for user auditors relying on controls over financial reporting"	SOC 1, Type 2
Auditor reduces substantive testing based on a Type 1 report	Inappropriate; Type 1 addresses design only
Report period ends three months before year end	Obtain a bridge letter; consider additional procedures for the gap
Report lists complementary user entity controls	The user auditor tests them at the user entity
"May the user auditor refer to the service auditor in the opinion"	No
Client's cloud provider has a SOC 2 Type 2	Evidence on IT security and availability; not reliance on transaction processing controls
Service auditor's independence is doubtful	The report is not sufficient appropriate evidence; perform other procedures

Where to practise this

The topic is one decision tree, and it is learned by running fact patterns through it until the SOC 1 versus SOC 2 and Type 1 versus Type 2 distinctions are reflexes. Prepito's AUD course covers service organizations, the SOC reports and AU-C 402 with practice questions whose explanations name the report and the type at stake in every option. The SOCPA Audit course covers ISA 402 as endorsed. For the risk model these reports feed, see The Audit Risk Model and Internal Control; for the section as a whole, the AUD study guide.

---

Sources: AICPA, System and Organization Controls (SOC) suite of services, AICPA, Statements on Auditing Standards currently effective (AU-C 402), IFAC profile of Saudi Arabia on SOCPA's adoption of the ISAs. Standards and the SOC framework are revised periodically; confirm the current text for a specific engagement.