SOC 2 Type 1 vs Type 2
Type 1 covers a single date, Type 2 a period. The choice sets your timeline, your cost and whether buyers accept the report.
The short answer: Type 1 or Type 2?
A SOC 2 Type 1 report covers whether controls are suitably designed on a single date. A SOC 2 Type 2 report covers design and whether the controls operated effectively over a period, typically 3 to 12 months; the AICPA sets no minimum. Both are issued by a licensed CPA firm, and both are reports, not certificates. Type 1 helps when a deal needs evidence soon; Type 2 is what most US enterprise buyers expect over time, so many companies get Type 1 first and move to Type 2, or go straight to Type 2 when they can wait out the period.
Point-in-time report
Tests whether controls are suitably designed on one date. No observation period.
Report over a period
Tests both the design and the operation of controls across the period.
How do SOC 2 Type 1 and Type 2 differ?
| Aspect | Type 1 | Type 2 |
|---|---|---|
| What is tested | Are the controls suitably designed? | Are the controls suitably designed AND did they operate effectively? |
| Date or period | A single date | A period, typically 3 to 12 months; the AICPA sets no minimum |
| How the auditor tests | Inquiry, plus inspection of documents and configurations as of the date | The same, plus sample testing of evidence across the period (for example access reviews, change tickets, alerts) |
| What the report contains | Auditor's opinion, management's assertion, system description | The same, plus a description of the tests performed and their results, including exceptions |
| Value to buyers | Shows the controls are in place | Shows the controls actually ran over time |
| Timeline (estimate) | Scope-dependent readiness, then one examination | Readiness, then a period of typically 3 to 12 months, then fieldwork and the report |
| What drives cost | Scope, Trust Services Categories, the CPA firm | The same, plus period length and the volume of sample testing |
| Best for | A deal that needs evidence soon; a step toward Type 2 | Selling to US enterprises long term; buyers whose vendor review asks for Type 2 |
Timelines are scope-dependent estimates, not promises. CPA firm fees are separate.
How do you get from Type 1 to Type 2?
- Readiness. Define the system and Trust Services Categories in scope, run a gap assessment and fix missing controls. Duration depends on scope and how ready you already are.
- Type 1. The CPA firm examines control design as of one date and issues the Type 1 report.
- The period. Controls run and evidence is kept continuously, typically for 3 to 12 months. Some companies choose a shorter first period to get a report sooner; agree it with your CPA firm and customers.
- Type 2 and after. The CPA firm tests samples from the whole period and issues the Type 2 report. It is then repeated yearly with consecutive periods; a bridge letter signed by management can cover a short gap between periods.
pTrackly assigns evidence tasks on a schedule, sends reminders before due dates and keeps the review history, so a Type 2 period has continuous evidence. Scope, running the controls and the audit opinion stay with your team and the CPA firm.
Frequently asked questions
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 tests whether controls are suitably designed on a single date. Type 2 tests design and whether the controls operated effectively over a period, typically 3 to 12 months, and the report adds a description of the tests and their results.
Does Type 1 require an observation period?
No. Type 1 is assessed as of one date, which is why it is faster than Type 2. You still need to finish readiness before that date.
Can you skip Type 1 and go straight to Type 2?
Yes. If no deal needs evidence soon, many companies go straight to Type 2 and avoid paying for two examinations. The first period can be shorter, by agreement with the CPA firm and your customers.
What is the minimum observation period for Type 2?
The AICPA sets no minimum. Periods typically run 3 to 12 months; the right length depends on what your customers expect and what the CPA firm recommends.
Will US enterprise buyers accept a SOC 2 Type 1 report?
Some will, especially if you show you are working toward Type 2. Many enterprise vendor reviews ask for Type 2, so check with the specific customer before you choose.
Turn compliance knowledge into work that gets done
Get step-by-step AI guidance, automated evidence collection, and live control status in one workspace.
In the call, we map your framework, system scope, and how pTrackly fits your current workflow.
Does not replace an independent auditor or certification body.