SOC 1, SOC 2, and SOC 3 Audit Services

Which report you need

SOC 1. Reports on controls relevant to your clients' internal control over financial reporting. If your service affects numbers that end up in a client's financial statements, such as payroll processing, claims administration, loan servicing, or third-party administration, their auditor will want a SOC 1. Issued under SSAE 18.

SOC 2. Reports on controls against the Trust Services Criteria: security, and optionally availability, processing integrity, confidentiality, and privacy. This is the report most technology and service companies are asked for during procurement and vendor risk review. Security is always included. The other four are scoped based on what you actually commit to in contracts.

SOC 3. A general use summary of a SOC 2 examination that can be posted publicly and shared without a nondisclosure agreement. It contains no detailed control descriptions or test results, which is what makes it distributable. It requires a SOC 2 underneath it.

Some organizations need both a SOC 1 and a SOC 2. That is common for administrators and processors whose service touches both financial reporting and sensitive data.

Type 1 versus Type 2

Type 1 evaluates whether your controls are suitably designed as of a single point in time. It is faster and cheaper, and it demonstrates that you have built the right controls.

Type 2 evaluates whether those controls operated effectively over a period, typically three to twelve months. This is what most sophisticated buyers actually want, because design without operation proves little.

The common path for a first-time examination is a Type 1 to establish the control environment, followed by a Type 2 covering the next period. If your buyer is holding a contract and will accept a Type 1 now, that sequence gets you an answer quickly without cutting corners. If they require a Type 2, we scope the observation period accordingly.

Readiness assessment first

We do not recommend walking into a first examination cold.

A readiness assessment maps your existing controls against the criteria, identifies gaps, and gives you a remediation list with a timeline. It surfaces the issues while they can still be fixed rather than after they appear as exceptions in a report your clients will read.

The assessment covers control environment and governance, access management and authentication, change management, system operations and monitoring, risk assessment, vendor and subservice organization management, and incident response. It also determines scope, which is where cost is decided. Companies routinely scope in systems and criteria they do not need, and narrowing that early saves real money.

Which report you need How a SOC examination runs

Scoping. We define which report, which type, which criteria, which systems, and which period. You get a written scope, fee, and timeline.

Readiness and remediation. Gap assessment, then your team addresses the gaps. We can advise on remediation approach while maintaining the independence the examination requires.

Control description. You draft the system description, and we review it. This document describes your service, your infrastructure, and your controls, and it becomes part of the final report.

Testing. We test the controls, request evidence through a single organized list, and interview control owners. For a Type 2, testing samples across the observation period.

Reporting. Draft report for your review, then the final signed report. You receive a report you can hand to clients and prospects immediately.

Annual cycle. SOC reports are point-in-time or period-specific, and buyers expect current ones. Most clients run an annual Type 2 with a rolling observation period. We schedule the next cycle at the close of the current one.

Beyond SOC: IT audit and general controls

Not every organization needs a SOC report. Some need the underlying work.

We perform IT general control reviews inside financial statement audits, evaluating access, change management, and computer operations for the systems that produce your financial data. We also perform standalone IT control assessments for organizations that want a picture of their environment without a formal attestation, and IT control testing for insurance carriers and benefit plan sponsors where regulators or fiduciary duty create the expectation.

How long does a SOC 2 take.

A first time Type 1 typically runs two to four months including readiness and remediation. A Type 2 adds the observation period, which is usually three to twelve months, plus testing and reporting after it closes.

What does a SOC audit cost.

It depends on report type, number of criteria, system complexity, and how many controls exist already. Scope drives cost more than company size does, which is why the readiness assessment pays for itself.

Can you do the readiness work and the examination.

Yes, within independence limits. We can assess, identify gaps, and advise on approach. We cannot design and implement your controls and then audit them. We will draw that line clearly during scoping.

We use a compliance automation platform. Does that replace the auditor.

No. Those platforms collect evidence and monitor controls, which makes the examination more efficient. The report still has to be issued by an independent CPA firm. We work alongside the common platforms.

Do our vendors need SOC reports too.

If a subservice organization performs functions relevant to your controls, the report has to address them, either by carving them out or including them. We handle that during scoping, and it often means collecting your vendors' SOC reports.

Is a SOC 2 the same as ISO 27001 or HITRUST.

No. They are different frameworks with different audiences. SOC 2 is a CPA attestation and is the dominant request in the United States. If your buyers are asking for something else, tell us and we will be honest about whether we are the right firm.