What Is the Difference Between a Vendor SOC 1 and SOC 2 Report?

Podcast Transcript

Welcome to this week’s Third Party Thursday! My name is Lisa Hill and I’m an Information Security Specialist here at Venminder. Today we are going to talk a little about SOC 1 and 2 reports, including what some of the differences are.

Let’s first cover why there are different kinds. Service Organization Control (SOC) reports are auditing reports that are issued in compliance with the SSAE 18 standard. The different kinds of SOC reports differ based on what they cover, how the auditor performs the assessment and what level of detail the reports include. This way, the vendor can avoid each client performing their own audit of the vendor’s system.

That being said, we can expect to see even more kinds of SOC reports in the future. But for now, the two most recognized are SOC 1 and SOC 2. These each have two particular types of their own, Type 1 and Type 2.

Let’s talk about the differences between a SOC 1 and SOC 2 report:

• SOC 1 reports are intended to review a vendor’s internal controls over financial reporting, as in how well they keep their books.
• SOC 2 reports cover controls related to the vendor’s Security, Availability, Processing Integrity, Confidentiality or Privacy. These areas are collectively called the 5 Trust Service Principles. Typically, two or more of the Trust Service Principles are selected to be reported on.

As I mentioned, there are two types of each SOC report. Type 1 and Type 2:

• Per the AICPA, Type 1 reports control effectiveness as of a point in time. It addresses the fairness of the system description and the suitability of the design of the controls in place needed to achieve the stated control objectives as of a specified date.
• Type 2 reports audit for a period of time. It addresses the fairness of the system and the suitability of the design AND operating effectiveness of the controls to achieve the related control objectives throughout a specified period.

Again, I’m Lisa and thanks for tuning in to this week’s third party Thursday; if you haven’t already done so, please subscribe to our series.