AUD Service Organizations · Updated November 2026

SOC 1 Type 1 or Type 2: Is the Report About Design or Operating Effectiveness?

Type 1 focuses on control design at a specified date. Type 2 adds operating effectiveness over a period.

Type 1

A Type 1 report addresses the description and design of relevant controls as of a specified date.

Type 2

A Type 2 report also includes testing and results related to operating effectiveness over a specified period.

User auditor use

The user auditor evaluates whether the report period, controls, complementary user controls, and findings are relevant to the financial statement audit.

Not an automatic substitute

A SOC 1 report helps the auditor understand outsourced controls but does not eliminate the user auditor's responsibility.

The takeaway

If the user auditor needs evidence that service-organization controls actually operated during the audit period, Type 2 is generally more useful.

Related Summit guides

Service organizationsContinue with a related Summit CPA Review guide.SOC reportsContinue with a related Summit CPA Review guide.Complementary controlsContinue with a related Summit CPA Review guide.

FAQ

Does Type 1 test operating effectiveness over a period?

No.

Does Type 2 include operating-effectiveness testing?

Yes.

Can SOC 1 reports be relevant to financial reporting controls?

Yes.