What is a SOC 2 Type I report?

What a Type I report covers

The report describes the system in scope, such as a SaaS product and the infrastructure, people and processes behind it, and states which Trust Services Criteria apply. The CPA firm examines whether the controls in that description are designed to meet those criteria and had been put in place as of the report date.

It says nothing about whether the controls kept working before or after that date. A Type I report dated 31 March gives no assurance that access reviews happened in January. That question is what a Type II report answers.

What is in the report

A Type I report has the same main parts as a Type II. What it lacks is the detailed testing of operating effectiveness, and the results of those tests, which make up much of a Type II report.

• Auditor’s opinion. The CPA firm’s conclusion, which is either unmodified or modified where the description or the design falls short.
• Management’s assertion. Your statement that the description is fair and the controls are suitably designed.
• System description. Your account of the services, boundaries, components and controls.
• Complementary controls. Controls your customers or subservice organisations must operate for yours to work, such as a customer managing its own user accounts.

When a Type I makes sense

A Type I suits a company that needs a report soon, usually because a deal depends on it, and whose controls are newly in place. It shows a buyer that the controls exist and are designed properly while a Type II observation period runs.

It is weaker evidence, and most enterprise buyers eventually ask for a Type II. If your controls already operate and nobody is waiting on a report, going straight to Type II avoids paying for two audits. If you do start with a Type I, plan the Type II period to begin soon after, so the reports follow on from each other.

Little of the work is wasted either way. Scoping, policies, the risk assessment and the system description written for the Type I carry over to the Type II.

Related terms

SOC 2 Type II

A SOC 2 report on whether controls operated effectively over an observation period. The report most enterprise buyers eventually ask for.

Trust Service Criteria

The five categories a SOC 2 report can cover: Security, which is always included, and optionally Availability, Confidentiality, Processing Integrity and Privacy.

Attestation report

An independent auditor’s written opinion on whether an organisation’s controls are designed, and in a Type II report operating, as described. A SOC 2 report is an attestation, not a certificate.

Observation period

The window, usually three to twelve months, over which a SOC 2 Type II auditor tests whether controls operated. It starts once the controls are in place.

Audit-ready

The point at which scoped controls, policies, a risk register and evidence are in place, so an auditor can be engaged and the audit can start without a scramble.