DataSecureA Type I report addresses the description and design of controls as of a specified date. A Type II report also addresses operating effectiveness throughout the period covered by the report. Ask intended report recipients what they accept before agreeing on scope with your auditor.
The difference at a glance
A SOC 2 examination addresses controls relevant to selected trust services categories. The AICPA description criteria address the description of the service organization’s system; the trust services criteria are used to evaluate relevant controls. An independent CPA firm performs the examination and issues the report.
A point in time
Does the system description and the design of controls meet the applicable criteria as of a specified date?
A period of time
Does the description and design meet the criteria, and did controls operate effectively during the period?
Period covered
| Question | Type I | Type II |
|---|---|---|
| Time covered | A specified date | A specified period |
| Control design | Addressed | Addressed |
| Operating effectiveness | Not tested over a period | Tested over the period |
| Typical evidence | Descriptions and design evidence | Design evidence plus records showing operation over time |
| Fit for your customer | Confirm with the recipient | Confirm scope and period with the recipient |
How to choose the right report
Start with the actual request. “We need SOC 2” can mean different things to different buyers. One procurement team may accept a Type I report as an initial milestone; another may specifically require Type II and a recent period. Do not assume either outcome.
- Ask your customer. Confirm report type, categories, system scope, reporting period and acceptable delivery date.
- Map the service. Identify the product, infrastructure, relevant people, processes and third parties.
- Assess readiness. Identify which controls exist, which need work and whether records are consistently retained.
- Talk to an independent CPA. Agree the report type, scope, criteria, period and responsibilities before committing to a deadline.
If a customer explicitly requires Type II, Type I is not an automatic substitute. Ask whether a staged approach is acceptable and document the agreed timeline.
What changes for evidence?
Consider a fictitious SaaS company with a control requiring authorized review before production code changes. The auditor determines which procedures and evidence are appropriate.
The team documents its process and identifies the systems and people involved.
Provide the process description and relevant configuration or records showing how the control is designed at the examination date.
Provide the population of changes and supporting review records for the period as requested by the auditor, including exceptions.
A screenshot alone may not show who reviewed a change or whether the control operated consistently. Useful evidence has context: source, scope, date, owner and relationship to the control. Preserve underlying records and explain gaps.
Planning your timeline
Type I is anchored to a date. Type II requires a period over which controls operate and evidence can be evaluated. The period is set for the engagement and should reflect customer needs and discussions with the auditor; there is no universal timeline that fits every organization.
Budget for remediation, internal reviews, evidence requests and the auditor’s work. Starting a Type II period before controls are operating consistently can lead to exceptions or evidence gaps.
What your team can do this week
- Collect exact report requirements and deadlines from customers.
- List services, systems and suppliers supporting the in-scope product.
- Assign owners for access, change management, operations and security policies.
- Check whether records are retained and retrievable for an agreed period.
- Discuss scope and a realistic schedule with a qualified independent CPA.
Common questions
Is SOC 2 a certification?
No. An independent CPA firm performs an examination and issues a SOC 2 report, not a certificate.
Do we have to complete Type I before Type II?
No. A staged approach depends on readiness, customer requirements and the engagement agreed with your auditor.
Does Type II mean every control passed?
Not necessarily. Read the auditor’s opinion, test results and any exceptions in the actual report.
Is a Type II report valid forever?
No. It covers a specified period. Customers may ask for a more recent report or information about a gap.
Sources and further reading
Continue planning your SOC 2 journey
- Build a realistic SOC 2 audit budget
- Understand the readiness assessment process
- See examples of evidence to collect
Educational guidance, not an audit opinion. Scope, criteria, procedures and evidence requirements depend on your organization and the examining CPA’s engagement.
Make your SOC 2 plan clearer.
Tell us what your customers are asking for. We’ll discuss readiness, evidence and next steps.
Book a demo ↗