SOC 1 and SOC 2 reports
A SOC 1 report covers a service organization's controls that affect its clients' financial reporting. A SOC 2 report covers controls related to security, availability, processing integrity, confidentiality or privacy.
A Type 1 report covers the design of controls at a point in time, and a Type 2 report also tests whether they operated effectively over a period. User auditors rely on SOC 1 reports, while customers and regulators often ask for SOC 2.
Example. A payroll processor gives its clients' auditors a SOC 1 Type 2 report, and gives a cloud customer's security team a SOC 2 Type 2 report.
By Binod Raj Singh, CPA (licensed in Montana) · Updated for the 2026-2027 exam windows · Last updated 2026-11-05