SOC 2 Report Types

If you’re landing on this page from a search engine, chances are you’re just starting out on your SOC 2 journey. You can find out more about Service Organisation Control (SOC) 2 in our SOC 2 hub, or read on to learn more about SOC 2 report types and how to achieve an unmodified opinion – aka a successful SOC 2 audit.

{{snapshot}}

SOC 2 reports in brief

• Proves data protection: a SOC 2 report is an internal-controls report showing how an organisation safeguards customer data.
• Two types: Type 1 evaluates controls at a snapshot in time; Type 2 evaluates them over a longer period such as six months or a year.
• Run by a CPA: unlike ISO 27001 audits, SOC 2 reports must be performed by a Certified Public Accountant (CPA).
• Built on AICPA principles: reports document controls across information security, availability, process integrity, confidentiality and privacy.

{{/snapshot}}

What is a SOC 2 report?

A SOC 2 report is an internal controls report illustrating how an organisation safeguards its customers’ data. The report also evaluates the effectiveness of the organisation’s controls over a specified time period. There are two different types of SOC 2 reports:

• SOC 2 Type 1;
• SOC 2 Type 2.

SOC 2 Type 1 reports evaluate the effectiveness of controls in a snapshot in time, while SOC 2 Type 2 reports evaluate the effectiveness of controls over the duration of a longer period, for example six months or a year.

Each report is based on the American Institute of Certified Public Accountants (AICPA) Trust Services Principles and documents the organisation’s controls in line with:

• Information security
• Availability
• Process integrity
• Confidentiality
• Privacy.

The scope of the report must include all criteria within each Trust Principle, which allows an auditor to assess the efficacy of a business’s operational and compliance controls.

Unlike ISO 27001 audits, which must be performed by a certified auditor, SOC 2 reports must be run by a Certified Public Accountant (CPA). SOC 1 evaluates internal controls relevant to a service organisation's client's financial statements, while a SOC 2 report addresses a service organisation's controls that are relevant to its operations and compliance.

In essence, a SOC 2 report is an auditor’s opinion of how an organisation’s controls fit the principal requirements.

{{snapshot}}

SOC 1 vs SOC 2, Type 1 vs Type 2

• SOC 1 vs SOC 2: SOC 1 covers controls relevant to clients’ financial statements; SOC 2 covers operations and compliance controls.
• Type 1 = design: establishes whether controls are suitably designed at a point in time.
• Type 2 = effectiveness: assures customers that controls effectively protect data over six to twelve months.

{{/snapshot}}

What is a SOC 2 Type 2 Report?

As we mentioned, SOC 2 Type 1 reports evaluate an organisation’s controls at a particular point in time, and SOC 2 Type 2 reports evaluate an organisation’s systems, controls and these controls’ effectiveness over a longer period, generally between six and twelve months.

SOC 2 Type 1 reports can be used by organisations to establish whether its controls are suitably designed. SOC 2 Type 2 reports, by contrast, assure an organisation’s customers and potential customers that the organisation effectively protects customer data and maintains a high level of information security.

Once the SOC 2 Type 2 audit is complete, the auditor will issue an opinion based on the control descriptions management has provided versus the actual effectiveness of the controls. This could be:

{{snapshot}}

In Hicomply’s experience

An unmodified opinion is the goal, and it comes from controls that genuinely work — not just tidy descriptions. Auditors issue qualified or adverse opinions when the two do not match, so build your evidence continuously rather than in a pre-audit rush. Because SOC 2’s controls overlap with ISO 27001, we recommend managing both in one compliance platform so nothing is duplicated.

{{/snapshot}}

Achieving SOC 2 Type 2 With Hicomply

Using the Hicomply tool, you and your compliance team can speed up preparation for your SOC 2 Type 2 audit and set your organisation up for success. The Hicomply workflow feature allows you to build the required policies and procedures for your SOC 2 compliance into automated, intelligent workflows.

Instead of painstakingly building out your processes, automatically trigger them within Hicomply, including the required notifications and stages to match the requirements of your ISMS or SOC 2 policy. The Hicomply dashboard also allows authorised users to see, quickly and easily, the status of risks, incidents and overall compliance, reducing the risk of key person dependencies and making your SOC 2 processes more efficient.

Learn more about SOC 2 in our SOC 2 hub.

Book your Hicomply demo