SOC 1 vs SOC 2 vs SOC 3: Differences and Which You Need
SOC 1 and SOC 2 are both CPA examinations of a service organization's controls, and they differ in subject matter. A SOC 1 report covers controls relevant to your customers' internal control over financial reporting (ICFR), and your customers' controllers and financial statement auditors read it. A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality, and privacy, tested against the AICPA Trust Services Criteria, and your customers' security and vendor risk teams read it. A SOC 3 is the short, general-use version of a SOC 2 Type 2 that you can publish. One question decides which you need: could an error in your service change a number in a customer's financial statements?
A common scoping mistake is buying the wrong report, such as a SOC 2 for a payroll customer whose auditor needed a SOC 1. BD Emerson performs SOC 1, SOC 2, and SOC 3 examinations through its CPA attest practice, and the decision rule below is the one we apply when scoping them.
SOC 1 vs SOC 2 vs SOC 3 at a glance
All three are attestation reports that a licensed CPA firm issues under AICPA standards, and none of them is a certification. The table compares them on the points buyers and auditors ask about.
| Attribute | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| Attestation standard | SSAE 18, AT-C section 320 | AT-C sections 105 and 205 | AT-C sections 105 and 205 |
| AICPA guide | SOC 1 guide, 2025 edition | SOC 2 guide, October 2022 edition | Covered in the SOC 2 guide |
| Subject matter | Controls relevant to customers' internal control over financial reporting | Controls relevant to security, availability, processing integrity, confidentiality, or privacy | Same as SOC 2 |
| Criteria | Control objectives written by service organization management | 2017 Trust Services Criteria (revised points of focus, 2022) and the 2018 description criteria | 2017 Trust Services Criteria |
| Who reads it | Customers' controllers, CFOs, and financial statement auditors | Customers' security, vendor risk, and compliance teams, and regulators | Prospects, partners, and the public |
| Distribution | Restricted to the service organization, its customers, and their auditors | Restricted to specified parties, usually shared under NDA | General use; can be posted publicly |
| Type 1 (design as of a date) | Yes | Yes | No |
| Type 2 (operating effectiveness over a period) | Yes, ordinarily six months or longer | Yes, commonly 3 to 12 months | Yes, issued from a SOC 2 Type 2 examination |
| Test results included | Yes, in a Type 2 | Yes, in a Type 2 | No |
Sources: AICPA SOC 1 guide (2025 edition), AICPA SOC 2 guide (October 2022 edition), 2017 Trust Services Criteria, and PCAOB AS 2601; read October 2026.
What a SOC 1 report covers
A SOC 1 report covers the controls at a service organization that affect its customers' financial statements. The AICPA defines SOC 1 as an examination of controls at a service organization "that are likely to be relevant to user entities' internal control over financial reporting," written for the user entities and for "the CPAs that audit the user entities' financial statements" (AICPA SOC 1 overview). The service auditor performs the work under AT-C section 320 of the attestation standards that SSAE 18 recodified, and the AICPA's SOC 1 guide, revised in 2025, explains how to apply it. Our SOC 1 report guide walks through each section of the report.
The services that draw SOC 1 requests create, process, or record transactions that end up in a customer's general ledger: payroll processing, benefits and claims administration, loan servicing, fund administration, billing and payments, and SaaS platforms that run a customer's revenue, payables, or close. In each case, a processing error at the service organization becomes a potential misstatement at the customer, which is why the customer's auditor wants evidence that the service organization controls it.
What a SOC 2 report covers
A SOC 2 report covers controls relevant to five Trust Services Categories: security, availability, processing integrity, confidentiality, and privacy. Every SOC 2 includes security, which the auditor tests against the 33 common criteria in the AICPA's 2017 Trust Services Criteria (with revised points of focus, 2022). The common criteria follow the 17 principles of the COSO 2013 internal control framework and add criteria for logical access, system operations, change management, and risk mitigation. You add the other four categories when a customer's question requires them. The system description follows the AICPA's 2018 description criteria, and the October 2022 edition of the SOC 2 guide governs how the examination runs.
The reader of a SOC 2 is the security engineer, vendor risk analyst, or compliance lead who decides whether your company can hold their data. That reader looks for access control, encryption, incident response, and vendor management, and unless processing integrity is in scope, the report says nothing about whether your payroll calculations or invoice totals are right.
How SOC 1 control objectives differ from the Trust Services Criteria
The structural difference between the two reports is who writes the criteria. In a SOC 1, service organization management writes the control objectives, and the service auditor evaluates whether they are reasonable for the service and relevant to customers' financial reporting. There is no fixed catalog, and the 2025 SOC 1 guide added guidance on the reasonableness of control objectives, because an objective that skips a risk the customer's auditor cares about weakens the whole report. In a SOC 2, the AICPA wrote the criteria, and every security examination answers the same 33 common criteria, so buyers can compare SOC 2 reports from different vendors line by line.
The same control often appears in both reports under different headings. The table follows one quarterly user access review through each report.
| Question | In a SOC 1 | In a SOC 2 |
|---|---|---|
| Where the control sits | Under an IT general control objective such as "Logical access to programs and data is restricted to authorized individuals" | Under common criteria CC6.2 and CC6.3, which cover registering, authorizing, modifying, and removing user access |
| What it protects | The integrity of financial data and the applications that process it | The system and its data against unauthorized access |
| Systems in scope | Applications and infrastructure that process transactions affecting customers' financial reporting | Every component inside the described system boundary |
| Who reads the result | The customer's financial statement auditor | The customer's security and vendor risk team |
Which report do you need? A decision rule
Start with one test: could an error, outage, or unauthorized change in your service cause a misstatement in a customer's financial statements? If the answer is yes, your customers' auditors need a SOC 1 to rely on your controls. Then ask whether a customer's security or vendor risk team reviews you before it shares data or connects systems. If it does, you need a SOC 2 as well, and many SOC 1 companies answer yes because financial data is sensitive data. Last, ask whether prospects evaluate you before they will sign an NDA, and if they do, add a SOC 3 to your SOC 2 Type 2. The figure lays out the rule.
The table applies the rule to common service types.
| Service | Report | Why |
|---|---|---|
| Payroll processor or PEO | SOC 1 Type 2, usually with a SOC 2 | Payroll expense, withholding, and payroll tax liabilities flow into customers' financial statements, and the service holds employee personal data. |
| Claims processor or third-party administrator | SOC 1 Type 2 and a SOC 2 | Paid claims and reserves drive the customer's claims expense, and the service handles protected health information, so healthcare buyers may also ask for HITRUST. |
| Billing, payments, or revenue cycle platform | SOC 1 Type 2 and a SOC 2 | Invoices, cash application, and receivables records feed revenue and cash balances, and the platform stores payment and customer data. |
| SaaS with no financial reporting impact, such as project management or marketing analytics | SOC 2, with an optional SOC 3 | No customer journal entry depends on the application, so a SOC 1 would have nothing to report on, and security reviews drive the requirement. |
| Colocation or managed data center | SOC 1 and SOC 2 | Customers' financial systems run on the infrastructure, so their auditors rely on physical access and environmental controls, while security teams want the SOC 2 view of the same controls. |
Borderline cases turn on calculation. A document portal for accounting firms does not calculate, post, or transform its customers' financial data, so their auditors do not rely on it and a SOC 2 fits. Once the portal calculates revenue schedules or tax amounts that flow into a customer's ledger, the answer moves toward a SOC 1.
SOC 1 Type 2 vs SOC 2 Type 2
A SOC 1 Type 2 and a SOC 2 Type 2 both test whether controls operated effectively over a period, and neither one substitutes for the other. "Type 2" describes the depth of the examination, and the SOC number describes the subject matter. A Type 1 covers design as of one date, and PCAOB AS 2601 says a report on controls placed in operation "is not intended to provide any evidence of the operating effectiveness of the relevant controls." AS 2601 also says a report that includes tests of operating effectiveness should ordinarily cover a minimum of six months, which is why SOC 1 periods usually run six to twelve months and line up with customers' fiscal years. SOC 2 windows are more flexible, and our article on SOC 2 Type 1 vs Type 2 covers how to sequence them.
When you need both, run them as one engagement
A company that needs both reports should scope them together, test shared controls once, and receive two reports with two opinions. The overlap is the IT general controls: logical access, change management, and computer operations appear as control objectives in the SOC 1 and as common criteria CC6, CC7, and CC8 in the SOC 2. The service auditor walks through each shared control once, selects one sample per control across the period, and reports the result in both documents. The rest stays separate: business process testing in the SOC 1, such as payroll calculations, claims adjudication, or cash application, and security-specific criteria in the SOC 2, such as risk assessment, vendor management, incident response, and security awareness.
Three scheduling choices make the combined engagement work. Align both review periods to the same dates, because a shared sample counts for both reports only when both cover the same months. Build one evidence request list and tag each item to the report it supports. Write both system descriptions from one source document, since a SOC 1 description follows AT-C section 320 and a SOC 2 description follows the 2018 description criteria.
How long each report takes and what it costs
A SOC 1 usually costs more than a SOC 2 of similar scope, because it tests business process controls on top of the IT general controls. The figures below are BD Emerson planning ranges for one service line as of October 2026, and a quote depends on the drivers named after the table.
| Report | Period covered | BD Emerson planning range, audit fee |
|---|---|---|
| SOC 1 Type 1 | One as-of date | $20,000 to $40,000 |
| SOC 1 Type 2 | 6 to 12 months | $30,000 to $60,000 |
| SOC 2 Type 1 | One as-of date | $7,000 to $25,000 |
| SOC 2 Type 2 | 3 to 12 months | $12,000 to $45,000 for startup and mid-market scope; $50,000 to $100,000 or more for enterprise scope |
| SOC 3 | Same period as the SOC 2 Type 2 | $2,000 to $8,000 added to the SOC 2 Type 2 |
Four things move a SOC 1 fee within its range: the number of control objectives, transaction volume (which sets sample sizes), the number of processing locations, and whether IT general controls are centralized or repeated across platforms. SOC 2 fees move with the categories in scope, the number of production systems, and the window length. Our SOC 2 cost breakdown adds readiness, tooling, and penetration testing to the audit fee.
Here is the arithmetic for a combined engagement, using planning numbers. A payroll platform scoped separately might see a SOC 1 Type 2 at $45,000 and a SOC 2 Type 2 at $30,000, a total of $75,000. Run on one twelve-month period with shared IT general control testing, BD Emerson's planning range for the combined fee is $52,500 to $63,750, a reduction of 15 to 30 percent. The larger saving sits with the client: the engineering team answers one set of access, change, and operations requests instead of two.
Timing follows the period. BD Emerson plans four to eight weeks from a Type 1 as-of date, or from the end of a Type 2 period, to a signed report when evidence is ready. A SOC 1 period should end where customers' auditors need it, which for calendar-year customers usually means a September 30 or December 31 period end, with a management-signed bridge letter covering any months between the period end and each customer's year end.
SOC 3: the public summary of a SOC 2
A SOC 3 report comes from the same examination as a SOC 2 Type 2 and leaves out the detail. The AICPA classifies it as a general use report that does "not provide the same level of detail" as a SOC 2 and "can be freely distributed" (AICPA SOC 3 overview). It carries the auditor's opinion, management's assertion, and a short system overview, and it omits the test results, which is why security teams still ask for the SOC 2 under NDA. Financial reporting has no SOC 3 equivalent, so a SOC 1 has no public summary. Scope a SOC 3 with the SOC 2 Type 2 when you want a trust page with real evidence; our SOC 3 report guide covers contents, cost, and when to skip it.
How buyers and auditors use each report
A SOC 1 is evidence in someone else's audit. When a public company's auditor audits internal control over financial reporting, PCAOB AS 2201, Appendix B, paragraphs B17 through B27, sets out how to use a service auditor's report: evaluate whether it provides sufficient evidence, compare the testing period with the date of management's assessment, ask management about changes at the service organization since the period ended, and test the customer's own controls over the outsourced activity. Per the note to paragraph B20, a report without tests of operating effectiveness "does not provide evidence of operating effectiveness." Auditors of private companies apply AU-C section 402. On the customer's side, the SOX team maps each complementary user entity control in your report to a control it owns.
A SOC 2 is evidence in a vendor risk decision. The reviewer reads the scope and system boundary first to confirm that the product they are buying is covered, then the complementary user entity controls the customer will own, the subservice organizations carved out of scope, and the exceptions. Many enterprise and regulated buyers make a current SOC 2 Type 2 a contract condition and ask for the new report every year.
Who issues SOC reports, and the independence line
Only a licensed CPA firm can examine and sign a SOC 1, SOC 2, or SOC 3 report, because each one is an attestation engagement under AICPA standards. BD Emerson's CPA attest practice performs SOC 1 Type 1 and Type 2 examinations under SSAE 18 (AT-C section 320), along with SOC 2 and SOC 3 examinations, from scoping through the signed opinion. Independence sets the boundary: the firm that examines your controls does not also implement them, so when our consultants have built part of a client's control environment, a different firm performs the examination.
Frequently asked questions
What is the difference between SOC 1 and SOC 2? A SOC 1 report covers a service organization's controls that are relevant to its customers' internal control over financial reporting, and customers' financial statement auditors use it. A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality, and privacy, tested against the AICPA Trust Services Criteria, and customers' security and vendor risk teams use it. Both come in Type 1 and Type 2 versions, and a licensed CPA firm issues both.
Can a SOC 2 report replace a SOC 1 report? No, because a SOC 2 does not test the control objectives a customer's financial statement auditor needs, such as the accuracy and completeness of payroll calculations or claims payments, so the auditor cannot rely on it for internal control over financial reporting. A SOC 1 cannot replace a SOC 2 either, because it does not answer the Trust Services Criteria a security reviewer measures. When both audiences ask, run both reports in one engagement with shared IT general control testing.
What is the difference between a SOC 1 Type 2 and a SOC 2 Type 2? Both test whether controls operated effectively over a review period, and both include the auditor's tests and results. A SOC 1 Type 2 tests control objectives tied to customers' financial reporting, and PCAOB AS 2601 says such a report should ordinarily cover at least six months. A SOC 2 Type 2 tests the Trust Services Criteria for security and any other categories in scope, often over three to twelve months. Each one answers a different reader.
Do SaaS companies need a SOC 1? A SaaS company needs a SOC 1 when its application processes transactions or produces data that customers record in their financial statements, such as billing, payroll, revenue recognition, expense management, or payables automation. A SaaS product with no effect on customers' ledgers, such as project management or marketing analytics, needs a SOC 2, and a SOC 1 would have nothing to report on. The test is whether a customer's auditor relies on the application.
Can the same auditor perform SOC 1 and SOC 2 at the same time? Yes, and it usually lowers the total cost. One CPA firm can run both examinations over the same review period, test shared IT general controls such as access, change management, and operations once, and issue two separate reports with two opinions. BD Emerson's planning range for the saving is 15 to 30 percent of the combined audit fee. The auditor must stay independent, so the firm that examines you cannot also implement your controls.
What is the difference between SOC 2 and SOC 3? A SOC 3 comes from the same examination as a SOC 2 Type 2 and reports on the same controls, but it omits the detailed system description and the test results. The AICPA classifies SOC 3 as a general use report that can be freely distributed, so companies post it on trust pages, while SOC 2 reports go to specified parties, usually under NDA. A SOC 3 typically adds $2,000 to $8,000 when scoped with the Type 2.
If a customer's auditor or security team has asked for a report and you are not sure which one, our SOC 1 audit team can read the request with you and scope the right examination, and our SOC 2 Type 2 audit team covers the security side. When both apply, we scope them on one review period from the start.
About the author
