Type 1 Vs. Type 2
A Type 1 report evaluates whether your controls are suitably designed as of a specific date. It costs less, is finished sooner, and shows that the control environment exists.
A Type 2 report evaluates whether those controls operated effectively over a period, usually twelve months but sometimes ranging down to three months. Most client auditors want a Type 2 because it gives them evidence that the controls worked during the period they are auditing.
Larson often recommends completing a Type 1 for your first year, because it allows you to provide a report to your clients quickly, with a lowered risk of reported exceptions (due to the “as of” date instead of testing for “operating effectiveness over a period of time”). Then, for your second report you can move to a Type 2, making sure that the controls that were tested for existence in the Type 1 are now operating effectively throughout the period. Make sure to check with your client’s auditor that they will accept a Type 1 for the current year.
SOC 1 Control Objectives
A SOC 1 has no fixed framework. You define the control objectives based on what your service does, which is the main structural difference from a SOC2.
Typical objectives cover:
-
Completeness and accuracy of transaction processing
-
Authorization of transactions
-
Accuracy of data received and output delivered
-
Timeliness of processing
-
Protection of client data
-
Restriction of system access to authorized users
-
Change management for in-scope applications
- Handling of errors and exceptions
Scope the objectives carefully. If they are too narrow, your client's auditor cannot rely on the report. If they are too broad, you pay to test controls no one asked about. Larson can help guide you as you put together your objectives.
Start With a SOC 1 Readiness Assessment
We recommend a readiness assessment before every first examination.
The assessment maps your existing controls to common objectives, identifies gaps, and produces a remediation list with a timeline. You fix problems before testing begins, so they do not appear as exceptions in a report your clients and their auditors will read.
Readiness also sets scope, and scope drives cost. Organizations often include systems and objectives they do not need.
Do we need a SOC 1 or a SOC 2?
If the request concerns your effect on a client's financial reporting, you need a SOC 1. If it concerns the security, availability, or confidentiality of data, you need a SOC 2. When the request is unclear, ask which report the auditor needs, or send us the language so we can help.
How does a SOC 1 handle our vendors?
If a subservice organization performs functions relevant to your control objectives, the report must address it. The carve-out method excludes the vendor's controls and describes the controls you expect the vendor to maintain and is the most common approach. The inclusive method brings the vendor's controls into your report. We settle the approach at scoping.
Can Larson perform both the readiness assessment and the examination?
Yes. We assess your controls and advise on gaps. Independence standards prohibit us from designing or implementing the controls we audit, and we define that boundary during scoping.
How often do we need a SOC 1 report?
Every year. Client auditors expect a current report covering their audit period, and a gap between report periods creates a problem for them.
Do you work with service organizations outside Utah
Yes. We perform SOC 1 examinations remotely for service organizations nationwide.
.png){kind=logo}
.png)
