What is a SOC 2 Type II report?

How Type II differs from Type I

A Type I report looks at control design on one date. A Type II report covers a period and adds testing of whether each control operated as described throughout it. For each control, the report sets out the tests the auditor performed and the results, including any exceptions found.

That testing is why buyers value it. A clean Type II shows that quarterly access reviews happened every quarter, that leavers lost access when they left, and that changes were approved before release, across months of operation.

How the auditor tests

The CPA firm samples evidence from across the whole period. Sample sizes depend on how often a control runs, so a daily or per-change control is sampled more heavily than a quarterly one. For each sample the auditor asks for the record that shows the control operated, such as a ticket, a log entry or a signed review.

• Inquiry. Asking control owners how the control works.
• Observation. Watching the control being performed.
• Inspection. Examining records and configurations from the period.
• Re-performance. Running the control again to check it gives the same result.

Exceptions and the opinion

Where a control did not operate as described, the auditor records an exception. Exceptions do not automatically lead to a modified opinion. Readers of the report judge how much each one matters, and management can include its response to them in the report.

A missed quarterly access review is a typical example. One missed review in a twelve-month period, explained and followed by a catch-up review, reads very differently from a control that never ran.

Planning the observation period

The period can only cover time in which the controls were already operating and leaving evidence. A first Type II often uses a shorter period, such as three or six months. Later reports usually run for twelve months and follow on from each other without a break.

Between reports, buyers may ask for a bridge letter. This is a statement from your management, rather than the auditor, that no significant changes have happened since the period ended.

Related terms

SOC 2 Type I

A SOC 2 report on whether controls are suitably designed and in place on a single date. Often the first report a company obtains.

Observation period

The window, usually three to twelve months, over which a SOC 2 Type II auditor tests whether controls operated. It starts once the controls are in place.

Exception (audit)

An instance where a control did not operate as described during the audit period. A SOC 2 report lists exceptions, and readers judge how much they matter.

Trust Service Criteria

The five categories a SOC 2 report can cover: Security, which is always included, and optionally Availability, Confidentiality, Processing Integrity and Privacy.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.