SOC 1 vs SOC 2 Audits: Which Report Your Business Needs in 2026

The short answer on SOC 1 vs SOC 2 audits: a SOC 1 examines the controls at a service organization that can affect its clients' financial statements, and a SOC 2 examines controls over security, availability, processing integrity, confidentiality and privacy of the systems that serve those clients. If your work feeds a customer's general ledger, expect SOC 1 requests. If your work holds or moves a customer's data, expect SOC 2 requests. Plenty of providers receive both.

Both reports belong to the AICPA's System and Organization Controls (SOC) suite and are issued by an independent CPA firm. This guide sets out how SOC 1 vs SOC 2 audits differ in scope, standards, report types and audience, plus SOC 3, bridge letters and how to decide, based on AICPA guidance current as of October 2026.

What a SOC 1 Report Covers

The AICPA describes SOC 1 as "an examination of controls at a service organization" that are "likely to be relevant to user entities' internal control over financial reporting" (AICPA-CIMA, SOC 1). Internal control over financial reporting, usually shortened to ICFR, is the set of processes that make a company's reported numbers reliable. When a company outsources part of that work, the controls move outside its walls, and its own auditors still need evidence that they work.

That is why the main reader of a SOC 1 is the customer's external auditor. The AICPA calls these readers "user auditors" and says SOC 1 reports serve "the CPAs that audit the user entities' financial statements." If you are a business owner trying to place this in context, our explainer on financial statement audits, reviews and compilations shows where an external audit sits and why auditors care about outsourced processes.

The standard behind SOC 1 is AT-C section 320. The AICPA's SOC 1 guide, updated in a 2025 edition, is "designed to help CPAs (service auditors) perform a SOC 1® examination under AT-C section 320" (AICPA-CIMA, SOC 1 Guide). AT-C 320 is one of the attestation sections codified by SSAE No. 18, "Attestation Standards: Clarification and Recodification," as amended. The AICPA's listing of currently effective SSAEs, current as of August 2026, still follows the SSAE No. 18 structure (AICPA-CIMA, SSAEs currently effective).

A SOC 1 report follows a set structure. Management writes a description of its system, asserts that it is fair, and sets its own control objectives, such as "payroll changes are authorized and recorded completely and accurately." The service auditor gives an opinion on the description and on whether the controls meet those objectives. The report also lists complementary user entity controls, the steps each customer must run on its own side.

Typical SOC 1 candidates include payroll processors, billing platforms, loan servicers, fund administrators and outsourced bookkeeping providers. If a failure in your process could put a wrong number in a customer's financial statements, expect SOC 1 requests. Companies whose own customers are public will feel this sooner, since Sarbanes-Oxley pushes their auditors to test outsourced controls as well. A SOX-lite approach to internal controls is a sensible way for a scale-up to prepare before that first request lands.

What a SOC 2 Report Covers

A SOC 2 measures controls against the Trust Services Criteria. The AICPA's own SOC 2 guide calls the engagement an "assertion-based examination of a service organization's description of its system" covering controls relevant to security, availability, processing integrity, confidentiality or privacy (AICPA-CIMA, SOC 2 Guide).

The criteria themselves are the 2017 Trust Services Criteria, which the AICPA describes as "control criteria established by the AICPA's Assurance Services Executive Committee" (AICPA-CIMA, 2017 TSC). In 2022 the AICPA revised the points of focus that sit under each criterion, which help auditors and management apply a criterion to a specific system. The update changed the points of focus and left the 2017 criteria in place, and the current SOC 2 guide applies the 2017 criteria with the 2022 revised points of focus alongside the 2018 description criteria.

In practice, every SOC 2 includes security, whose common criteria form the core of the framework. The other four categories are added when they matter to customers: a cloud platform with uptime commitments usually adds availability, and a company holding personal information often adds confidentiality or privacy. More categories mean more testing.

In a SOC 2, management designs its controls and the auditor tests them against published criteria instead of objectives management writes. That makes SOC 2 reports easier to compare across vendors. Our guide to SOC 2 for accounting firms and ISO 27001 vendor due diligence shows how firms read these reports when choosing a provider.

Typical SOC 2 candidates are SaaS platforms, cloud hosts, data processors, managed IT providers and any outsourcer that stores or touches client records. For a finance-focused view of SaaS operations, see our piece on outsourced accounting for SaaS companies.

SOC 1 vs SOC 2 Audits Side by Side

The table below sets out the main differences in one place.

In practice, a SOC 1 tells a customer's auditor whether it can rely on your controls over the customer's numbers, and a SOC 2 tells a customer whether its data and service are protected in your hands.

Type 1 vs Type 2 Reports

Both SOC 1 and SOC 2 come in two types. A 2016 explainer in the AICPA's Journal of Accountancy describes a Type 1 report as one that "focuses on a description of a service organization's system" and the suitability of control design as of a specified date. A Type 2 report "contains the same opinions as a type 1 report," plus an opinion on whether the controls operated effectively over a specified period (Journal of Accountancy).

In plain terms, a Type 1 checks the design on one day. A Type 2 checks the design and then tests whether the controls actually ran, with sample testing across a review window. The AICPA's SOC 1 guide covers "how a user auditor uses a type 1 or type 2 report," and in practice most user auditors want a Type 2, since a single-day snapshot gives them little evidence about the months that make up their client's fiscal year.

Companies facing their first SOC request often issue a Type 1 to show customers that controls are designed and in place, then start the Type 2 window right after. Enterprise SOC 2 buyers often follow the same pattern and ask for a Type 2. Our 2026 guide to SOC 2 Type II compliance in secure outsourcing covers what a Type II program looks like once it is running.

Typical audit periods

The attestation standards do not fix a single length for a Type 2 period. In practice, review windows commonly run from six to twelve months, first-time reports sometimes use a shorter window, and mature programs move to a twelve-month period that repeats each year. For SOC 1, providers usually set the period to overlap most of their customers' fiscal years. The final period is agreed with the service auditor.

Where SOC 3 Fits

SOC 3 uses the same Trust Services Criteria as SOC 2. The AICPA says SOC 3 reports "are considered general use reports and can be freely distributed" (AICPA-CIMA, SOC 3). They leave out the detailed control descriptions and test results that appear in a SOC 2, which is why companies post them on trust pages or share them early in a sales cycle.

Security teams still request the full SOC 2 under a nondisclosure agreement, since they want the detailed tests and any exceptions. There is no SOC 3 equivalent for financial reporting controls.

Bridge Letters and Report Coverage

A SOC report covers a fixed period, and customers' fiscal years rarely line up exactly with it. If a SOC 1 period ends September 30 and the customer's year ends December 31, the user auditor has three months with no coverage. The usual fix in practice is a bridge letter, sometimes called a gap letter. Service organization management signs it, and it states whether there have been material changes to the system or controls since the period ended. The CPA firm does not opine on a bridge letter, so user auditors treat it as management's representation and may perform extra procedures if the gap is long.

This is also why most providers repeat the examination every year. A report whose period ended more than a year ago is hard for a reviewer to rely on, so planning the next examination early keeps coverage continuous.

How to Decide Which Report You Need

Start with the requests you are receiving. A request from a customer's controller or external auditor, or one that cites financial reporting or SOX, points to SOC 1. A request in a security questionnaire, a procurement checklist or a data protection addendum points to SOC 2. When you cannot tell, ask the requester what they plan to do with the report.

Then look at what your service touches. Processing transactions, calculating balances or producing data that lands in a customer's ledger is SOC 1 territory. Hosting, storing or transmitting customer data is SOC 2 territory. Many outsourced finance providers do both, and the vendor risk assessment questions that cover SOC 2, GDPR and ISO 27001 show how buyers weigh the security side separately from the financial side.

Finally, check readiness. Gaps in basic internal control will show up as exceptions in a Type 2 of either kind.

A readiness assessment usually maps current controls to the SOC 1 objectives or the Trust Services Criteria, fixes the gaps, and runs controls long enough to produce evidence. Teams that already do periodic internal controls testing tend to move through readiness faster. On the security side, an offshore accounting security checklist covering SOC 2, ISO and VDI gives a useful list of the technical controls auditors will test.

What it costs

The AICPA does not publish fee ranges for SOC examinations, and fees vary widely between CPA firms. Price depends on report type, categories in scope, period length, the number of systems and how much remediation is needed. Get written quotes from more than one licensed CPA firm with SOC experience before budgeting.

Example Scenario: A Payroll Platform Facing Both Requests

Consider a US payroll software company with 150 business customers. In January, a customer's audit firm asks for a SOC 1 Type 2 because payroll expense and withholding liabilities are material to that customer's financial statements. In March, a different customer's IT team sends a security questionnaire asking for a SOC 2 Type 2 covering security and confidentiality, since the platform stores employee Social Security numbers and bank details.

The two requests need different reports. The company runs one readiness review against both the SOC 1 control objectives and the Trust Services Criteria, since access reviews, change management, backups and incident response appear in both. It issues a Type 1 for each by mid-year, then starts a twelve-month Type 2 window from October 1 to September 30.

For the calendar-year customer, the SOC 1 Type 2 covers nine months of the fiscal year, and management issues a bridge letter for October through December. It also posts a SOC 3 on its website for prospects. Firms comparing outsourced payroll providers for accounting firms will often see this pairing of reports.

What Changed for SOC Reporting Heading Into 2027

The Trust Services Criteria have not changed since the 2022 points of focus update, and the SOC 1 guide received a 2025 edition. The bigger item is a revision of the attestation standards themselves. On February 5, 2026 the AICPA announced an exposure draft covering "updates to the baseline attestation standards to address evolving practice" and "two new AT-C sections related to engagements to report on sustainability information." The AICPA said "adoption of the updates is expected to occur next year," after further Auditing Standards Board deliberation (AICPA-CIMA news). The Journal of Accountancy reported that the proposal would be effective for engagements beginning on or after June 15, 2029. SOC examinations run under those baseline standards, so auditors may adjust procedures once a final standard is issued, though the choice of report stays the same. Our explainer on materiality and risk in audits covers how auditors weigh findings.

Frequently Asked Questions

What is the main difference between SOC 1 and SOC 2? A SOC 1 covers controls at a service organization that affect customers' internal control over financial reporting. A SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality and privacy, measured against the AICPA's Trust Services Criteria.

Can a company need both a SOC 1 and a SOC 2? Yes. Payroll, billing and outsourced accounting providers often process financial data and hold sensitive personal information, so different customers ask for different reports. Many providers run both examinations on the same period to share evidence.

Is a SOC 2 a certification? No. A SOC 2 is an attestation report containing a CPA firm's opinion, and it can include exceptions. Readers should review the opinion and the test results instead of treating the report as a pass or fail badge.

How long is a SOC report valid? There is no formal expiry date. Reviewers usually expect the period to have ended within the past twelve months, which is why most providers repeat the examination annually and use a bridge letter for short gaps.

Who can perform a SOC 1 or SOC 2 examination? Only a licensed CPA firm can issue the opinion, since SOC reports are attestation engagements under AICPA standards. Consultants and software tools can help with readiness, though they cannot sign the report.

Next Step

Madras Accountancy supports US CPA firms with SOC engagement work, including control documentation, evidence compilation and testing support, through our audit support outsourcing teams. We hold SOC 2 Type II and ISO 27001, and our approach to data security for offshore teams under AICPA, IRS and FTC rules is documented for your own vendor review. To scope support for your next SOC engagement, contact our team.