SOC 2 Type 1 or Type 2: Design at a Date or Operating Effectiveness Over Time?
Type 1 looks at design as of a specified date. Type 2 also tests operating effectiveness over a period.
Type 1
Addresses management's description and the design of controls relevant to the selected Trust Services Criteria as of a specified date.
Type 2
Adds testing of operating effectiveness over a specified period and includes the service auditor's test procedures and results.
Trust Services Criteria
SOC 2 engagements can cover security and other selected categories such as availability, processing integrity, confidentiality, and privacy.
Not SOC 1
SOC 2 focuses on Trust Services Criteria rather than controls specifically relevant to user entities' financial reporting.
The takeaway
If a user needs evidence that controls actually operated consistently during a period, Type 2 generally provides more relevant assurance.
Related Summit guides
FAQ
Does SOC 2 Type 1 test operating effectiveness over a period?
No.
Does Type 2 include operating-effectiveness testing?
Yes.
Is SOC 2 the same as SOC 1?
No.