Choosing between a SOC 2 Type 1 and Type 2 report is one of the first strategic decisions organisations face when pursuing SOC 2 compliance. Both report types are issued by an independent CPA firm and follow the same Trust Service Criteria defined by the AICPA, but they differ significantly in scope, duration, cost, and the level of assurance they provide to customers and stakeholders. This guide breaks down those differences in detail so you can make an informed decision based on your organisation’s stage, budget, and customer requirements.
What is a SOC 2 report?
A SOC 2 report is an independent audit report that evaluates a service organisation’s controls related to the Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is always in scope; the remaining four criteria are optional and selected based on the nature of the services you provide.
The audit is performed by a licensed CPA firm (or equivalent body) following the attestation standards set by the AICPA. The resulting report is intended for use by customers, prospects, regulators, and other stakeholders who need assurance that your organisation handles data responsibly.
There are two types of SOC 2 report — Type 1 and Type 2 — and understanding the distinction between them is essential for planning your compliance programme.
SOC 2 Type 1 explained
A SOC 2 Type 1 report evaluates the design of your controls at a single point in time. The auditor examines whether your controls are suitably designed to meet the applicable Trust Service Criteria as of a specific date — for example, 15 March 2026.
What the auditor evaluates
In a Type 1 engagement, the auditor reviews:
- Your system description, including infrastructure, software, people, procedures, and data
- The control objectives you have defined for each Trust Service Criterion in scope
- Whether each control is suitably designed to achieve its stated objective
- Whether the controls have been implemented (i.e., they exist and are in place as of the report date)
The auditor does not test whether the controls have been operating effectively over time. They confirm that the controls exist and are properly designed, but they do not verify sustained operation.
What the report contains
A Type 1 report typically includes:
- Management’s assertion — your organisation’s formal statement that the system description is accurate and controls are suitably designed
- System description — a detailed narrative covering infrastructure, data flows, personnel, and procedures
- Auditor’s opinion — the CPA firm’s independent opinion on whether controls are suitably designed and implemented
- Control matrix — a listing of each control, the criteria it addresses, and the auditor’s assessment of its design
Typical timeline
From readiness assessment to final report, a SOC 2 Type 1 engagement typically takes one to three months. This assumes the organisation has already implemented its controls and documented its policies. If you are building your control environment from scratch, add two to four months of preparation time.
Cost range
Audit fees for a SOC 2 Type 1 typically range from £10,000 to £50,000, depending on the size of the organisation, the number of Trust Service Criteria in scope, and the complexity of the technology environment. Costs on the lower end are common for smaller SaaS companies with straightforward infrastructure; larger organisations with multiple data centres, complex integrations, or additional criteria in scope will fall toward the higher end.
SOC 2 Type 2 explained
A SOC 2 Type 2 report evaluates both the design and the operating effectiveness of your controls over a defined period of time. Where a Type 1 asks “are your controls properly designed?”, a Type 2 asks “are your controls properly designed and have they been working as intended throughout the observation period?”
The observation period
The observation period — sometimes called the audit window or review period — is the span of time during which the auditor assesses whether controls operated effectively. Common observation periods are:
- 3 months — the minimum accepted period; sometimes used for a first Type 2 report
- 6 months — a common choice for organisations transitioning from Type 1 to Type 2
- 12 months — the standard for mature organisations and the duration most enterprise customers expect
The observation period is agreed upon with your auditor before the engagement begins. During this period, your controls must be operating consistently, and you must retain evidence of that operation.
What auditors look for
During a Type 2 engagement, auditors perform substantive testing of your controls. This includes:
- Sampling — selecting a sample of instances where a control should have operated (e.g., access reviews, change approvals, incident responses) and verifying that it did
- Inspection — reviewing documentation, logs, screenshots, and records that demonstrate control operation
- Observation — in some cases, directly observing a control in operation
- Re-performance — independently performing a control procedure to confirm it produces the expected result
- Inquiry — interviewing personnel responsible for executing controls to understand processes and identify gaps
If a control did not operate effectively for a portion of the observation period, the auditor will note an exception. Exceptions do not automatically result in a qualified opinion, but they are disclosed in the report and may raise concerns with customers reviewing it.
Evidence requirements
Type 2 audits require substantially more evidence than Type 1 engagements. You need to demonstrate that controls operated consistently throughout the observation period, not just that they existed at a point in time. Common evidence includes:
- Access review records and approval documentation
- Change management tickets with approval chains
- Vulnerability scan results and remediation records
- Incident response logs and post-mortem documentation
- Backup and recovery test results
- Security awareness training completion records
- Vendor risk assessment documentation
- Policy review and update records with version history
Maintaining this evidence manually is time-consuming and error-prone. Many organisations use compliance automation platforms to collect and organise evidence continuously.
Detailed comparison table
| Aspect | SOC 2 Type 1 | SOC 2 Type 2 |
|---|---|---|
| What is evaluated | Control design and implementation | Control design and operating effectiveness |
| Assessment basis | Single point in time | Period of time (3–12 months) |
| Typical timeline | 1–3 months (excluding preparation) | 3–12 month observation period, plus preparation |
| Total time to report | 2–5 months | 6–15 months |
| Audit cost | £10,000–£50,000 | £20,000–£100,000+ |
| Evidence volume | Moderate — policies, configurations, system description | Extensive — continuous logs, samples, records across the full period |
| Testing approach | Inspection of control design | Sampling, inspection, observation, re-performance, inquiry |
| Customer perception | Acceptable for early-stage companies | Preferred by enterprise buyers; often required |
| Exceptions reporting | Not applicable (no operating effectiveness testing) | Exceptions noted and disclosed in the report |
| Renewal cadence | Not typically renewed; serves as a stepping stone | Renewed annually with continuous observation periods |
| Best suited for | First-time SOC 2 compliance; validating control design | Demonstrating sustained compliance to customers and partners |
Which type should you choose?
The right choice depends on several factors. Use the following decision framework to guide your selection.
Choose Type 1 if:
- You are pursuing SOC 2 compliance for the first time and want to validate your control design before committing to a longer engagement
- You need a SOC 2 report quickly — for example, to close a specific deal or satisfy an immediate customer requirement
- Your budget is limited and you want to spread the cost of compliance over two phases
- Your control environment is newly implemented and has not been operating long enough to support a Type 2 observation period
- Your customers or prospects will accept a Type 1 report as an interim measure
Choose Type 2 if:
- Your customers or procurement processes explicitly require a Type 2 report
- You have mature, well-documented controls that have been operating consistently for at least three months
- You want to maximise the trust signal your SOC 2 report provides
- You are competing for enterprise contracts where Type 2 is a baseline expectation
- You already hold a Type 1 report and are ready to progress to the next level of assurance
Choose to go directly to Type 2 if:
- Your controls have been operating for six months or longer, even without a prior Type 1
- You have confidence in your control environment and want to avoid the cost of two separate audits
- Your timeline allows for the longer observation period without delaying critical sales opportunities
Common progression path
The most common approach for organisations new to SOC 2 is a two-phase progression:
Phase 1 — SOC 2 Type 1. Implement your controls, document your policies, and engage a CPA firm to assess your control design. This validates that your controls are suitably designed and gives your team experience with the audit process. A Type 1 report can be shared with customers and prospects as evidence of your commitment to security, even while you prepare for a Type 2.
Phase 2 — SOC 2 Type 2. After obtaining your Type 1, begin the observation period for your Type 2 audit. Many organisations start the observation period immediately after the Type 1 report date, so there is no gap in coverage. The Type 2 auditor will test the same controls evaluated in the Type 1, but this time they will assess operating effectiveness over the full observation period.
This phased approach reduces risk. If the Type 1 audit reveals control design issues, you can remediate them before they become exceptions in a Type 2 report. It also allows you to provide a SOC 2 report to customers sooner, rather than waiting 12 or more months for a Type 2 to be completed.
Can you skip Type 1 and go straight to Type 2?
Yes. There is no requirement from the AICPA or any regulatory body to obtain a Type 1 report before pursuing a Type 2. Some organisations — particularly those with mature security programmes or experienced compliance teams — choose to skip the Type 1 entirely and proceed directly to a Type 2 engagement.
This approach has clear advantages: it saves the cost of a separate Type 1 audit and delivers the more valuable report type sooner. However, it carries risk. If your controls are not well-designed or consistently operated, you may receive exceptions in your Type 2 report that would have been caught and corrected during a Type 1 assessment.
Before deciding to skip the Type 1, consider conducting a readiness assessment — either internally or with a third-party consultant. A readiness assessment simulates the audit process and identifies gaps in control design and documentation without the formal commitment of a full audit engagement. This gives you the benefits of a Type 1’s validation without the cost of a formal report.
What happens during each type of audit
Type 1 audit — practical walkthrough
A Type 1 audit is relatively compact. Here is what to expect:
-
Scoping and planning (week 1–2). The auditor agrees on the Trust Service Criteria in scope, the report date, and the system boundaries. You provide an initial system description and control matrix.
-
Documentation review (week 2–4). The auditor reviews your policies, procedures, and control descriptions. They assess whether each control is suitably designed to meet the relevant criteria. Expect questions and requests for clarification.
-
Evidence collection (week 3–5). You provide evidence that controls are implemented as of the report date. This typically includes screenshots of configurations, copies of policies, organisational charts, network diagrams, and access lists.
-
Fieldwork and testing (week 4–6). The auditor performs walkthroughs of key controls, interviews control owners, and inspects evidence. For a Type 1, this is focused on design assessment — they are confirming controls exist and are properly constructed, not that they have been operating over time.
-
Draft report and management response (week 6–8). The auditor issues a draft report. You review the system description for accuracy and provide management’s assertion. If any control design issues were identified, you discuss remediation.
-
Final report (week 8–10). The auditor issues the final SOC 2 Type 1 report. This is the document you share with customers and prospects.
Type 2 audit — practical walkthrough
A Type 2 audit is longer and more intensive due to the observation period.
-
Scoping and planning (month 1). Similar to Type 1 — agree on criteria, system boundaries, and the observation period. The start date of the observation period is typically backdated to when your controls began operating consistently.
-
Observation period (months 1–12). During this phase, your controls must operate as designed. You are responsible for collecting and retaining evidence of control operation throughout the period. This is where compliance automation platforms provide the most value — they continuously collect evidence so you do not need to rely on manual processes.
-
Interim testing (optional, mid-period). Some auditors perform interim testing partway through the observation period. This helps identify issues early so they can be remediated before the final testing phase.
-
Final fieldwork (weeks 2–4 after observation period ends). The auditor performs substantive testing across the full observation period. They select samples from throughout the period — not just the beginning or end — to verify consistent operation. Expect requests for specific records, logs, tickets, and documentation.
-
Exception handling. If the auditor identifies instances where a control did not operate as designed, these are documented as exceptions. You have the opportunity to provide context or supplementary evidence, but the exception will be disclosed in the report.
-
Draft report and management response (weeks 2–3 after fieldwork). You review the draft, confirm the system description, and provide management’s response to any exceptions.
-
Final report (week 3–4 after fieldwork). The final SOC 2 Type 2 report is issued. This covers the full observation period and includes the auditor’s opinion on both design suitability and operating effectiveness.
How to prepare evidence for each type
Type 1 evidence preparation
For a Type 1 report, focus on demonstrating that controls are designed and implemented as of the report date:
- Policies and procedures — ensure all required policies are documented, approved, and current. Common policies include information security, access control, change management, incident response, data classification, and acceptable use.
- System configuration evidence — screenshots or exports showing security configurations, access controls, encryption settings, logging configurations, and network architecture.
- Organisational documentation — organisational charts, role descriptions, and responsibility assignments for security and compliance functions.
- Risk assessment — a documented risk assessment covering the systems in scope, with identified risks and corresponding controls.
- Vendor management records — documentation of third-party risk assessments for critical vendors.
Type 2 evidence preparation
For a Type 2 report, you need everything required for a Type 1, plus evidence of consistent control operation over the observation period:
- Access reviews — records of periodic access reviews (typically quarterly) showing who reviewed access, what decisions were made, and when access was revoked for terminated employees or role changes.
- Change management records — tickets or records for every change to production systems, showing proper approval, testing, and deployment procedures were followed.
- Incident response records — documentation of security incidents, including detection, response, resolution, and post-mortem analysis. If no incidents occurred, document that as well.
- Monitoring and alerting logs — evidence that security monitoring tools were active throughout the period and that alerts were reviewed and addressed.
- Training records — completion records for security awareness training, showing all personnel completed training within the required timeframe.
- Backup and recovery tests — documentation of periodic backup tests confirming that data can be restored successfully.
- Vulnerability management — scan results and remediation records showing vulnerabilities were identified and addressed within defined timeframes.
Impact on sales cycles and enterprise deals
The type of SOC 2 report you hold directly affects your ability to close enterprise deals. Understanding this impact helps you prioritise your compliance investments.
Type 1 in sales conversations
A Type 1 report demonstrates commitment to security and validates that your controls are properly designed. For many mid-market buyers and early-stage enterprise evaluations, a Type 1 is sufficient — particularly if you can demonstrate a clear timeline for obtaining a Type 2.
However, a Type 1 has limitations in competitive situations. If a prospect is evaluating you against a competitor that holds a Type 2 report, the competitor has a meaningful advantage. The Type 2 provides stronger assurance, and procurement teams understand the difference.
Type 2 in sales conversations
A Type 2 report is the standard expectation for enterprise procurement. It demonstrates not only that your controls are well-designed but that they have been operating effectively over an extended period. This significantly reduces the perceived risk of working with your organisation.
Holding a current Type 2 report can:
- Shorten security review cycles — procurement and security teams can review your SOC 2 report instead of conducting lengthy custom security questionnaires
- Reduce friction in vendor onboarding — a Type 2 report satisfies many of the due diligence requirements that enterprise buyers must complete
- Support larger deal sizes — enterprise customers are more willing to commit significant spend to vendors that can demonstrate sustained compliance
- Enable faster contract execution — security and legal reviews move more quickly when a Type 2 report is available
Practical guidance
If you are selling to enterprise customers, plan for a Type 2 report. The investment pays for itself through faster sales cycles, reduced security questionnaire burden, and increased win rates in competitive evaluations. If budget or timeline constraints prevent an immediate Type 2, obtain a Type 1 and communicate your Type 2 timeline clearly to prospects. Most enterprise buyers will accept this as an interim measure if the timeline is credible and documented.