[ Answers · Fintech ]

SOC 2 Type 1 vs Type 2

By Ben Tabas, Intrica Research · Updated · US

Answer

A SOC 2 Type 1 report covers whether a company's controls are suitably designed as of one date. A Type 2 report covers design and operating effectiveness throughout a specified period, as CPA firm Johanson LLP summarized the AICPA definitions on March 10, 2026. Wolf & Company says Type 2 suits companies that need to show clients their controls work over time.

What each report tests

  • Type 1: the auditor reviews the system description and whether controls are suitably designed as of a specified date.
  • Type 2: the auditor reviews the same things and tests whether the controls operated effectively throughout a specified period.
  • Wolf & Company, a CPA firm, wrote on Oct. 14, 2023 that a Type 1 does not assess whether controls are operating effectively.
  • Both reports are issued by a CPA firm under AICPA standards.

How long the Type 2 period runs

The AICPA definition says a specified period. CPA firms set the length with the client.

Johanson LLP, on March 10, 2026, puts the minimum at three months for a first Type 2 and says some customers want six months.

Wolf & Company, on Oct. 14, 2023, gives six to 18 months and says 12 months is common.

How to choose

  1. Start with a Type 1 if a deal needs a report soon and your controls are new. Wolf & Company calls this a foundation for a first audit.
  2. Begin the Type 2 observation period once controls are running.
  3. Pick the trust services categories in scope. The AICPA lists security, availability, processing integrity, confidentiality and privacy.
  4. Watch the criteria. The AICPA posted exposure drafts of proposed 2027 Trust Services Criteria on Oct. 26, 2026.

Check whether AI engines can quote your security page when buyers ask if you have a SOC 2 Type 2 report.

Run the free Answerability ScoreBook a call

Sources

  1. What is the difference between SOC 2 Type 1 and SOC 2 Type 2 · Johanson LLP, March 10, 2026Supports: Its summary of the AICPA definitions of Type 1 and Type 2 and the three month minimum period.
  2. Type 1 vs. Type 2 SOC Reports: What's the Difference? · Wolf & Company, Oct. 14, 2023Supports: What each report tests, the six to 18 month range and when to choose each.
  3. SOC 2 · AICPA & CIMA, Oct. 26, 2026Supports: Exposure drafts of the proposed 2027 Trust Services Criteria, posted Oct. 26, 2026.
  4. System and Organization Controls: SOC Suite of Services · AICPA & CIMA, Oct. 28, 2026Supports: Checked Oct. 28, 2026: the five trust services categories named in the AICPA guide title.

Related questions

Intrica helps fintech companies get found in Google and named in AI answers. Fintech SEO →