SOC Type 1 vs Type 2: Assessment & Attestation Explained

Every SOC report — SOC 1 and SOC 2 alike — comes in two depths: Type 1 and Type 2. A Type 1 says your controls were suitably designed on a given date. A Type 2 says they were designed and operated effectively across a review period. The distinction decides your timeline, your cost and whether the report actually satisfies the client who asked for it. Philippine providers planning a first SOC engagement should settle this before committing dates to anyone.

Type 1: design at a point in time

A Type 1 report examines two assertions as of a specific date: that your system description is fairly presented, and that the controls in it are suitably designed to meet the control objectives (SOC 1) or the Trust Services Criteria (SOC 2). The CPA firm inspects design and implementation — not the track record. It answers the question “have they built the right controls?” and can be produced relatively quickly once readiness work is done, which is why it works well as a first proof point for a provider that has never been examined.

Type 2: operating effectiveness over a review period

A Type 2 report covers everything in a Type 1, then tests whether the controls actually operated effectively throughout a review period — commonly three to twelve months, with six or twelve the usual choices. The CPA firm samples evidence across the whole window: access reviews performed on schedule, changes approved before deployment, backups tested, incidents handled per procedure. A month of missing evidence becomes an exception in the report your clients read. That is the point — Type 2 proves discipline over time, which is what risk teams are actually buying.

What clients accept in practice

The market has moved: enterprise vendor-risk teams and client financial auditors increasingly accept only Type 2, treating Type 1 as a stepping stone rather than an answer. A Type 1 still has real uses — unblocking a deal while your Type 2 window runs, proving a new service line’s controls, satisfying a smaller client — but present a Type 1 to a sophisticated buyer two years running and expect hard questions. When a contract says a SOC 2 is required, assume Type 2 unless the client confirms otherwise in writing.

The typical path: Type 1 first, then straight into Type 2

The sequence that works: readiness first — gap assessment, control build, evidence routines — then a Type 1 examination to lock the design, then open the Type 2 review period immediately, often the day after the Type 1 date, so the first Type 2 report lands as early as possible. Some providers skip Type 1 entirely and go straight to Type 2; that saves one examination fee but gives up the early proof point and the rehearsal value. We plan the choice around your client commitments, not the auditor’s calendar.

Planning the review window well

Three planning rules. First, do not open the window until controls genuinely operate — every gap inside the window surfaces as a tested exception. Second, choose the period length commercially: a six-month first window gets a report into clients’ hands sooner, and twelve-month windows then become the annual rhythm. Third, run evidence collection as a weekly habit, not a quarter-end scramble. Sterling builds that discipline during readiness for BPO and IT providers — the same habit that keeps ISO 27001 surveillance audits clean (see ISO 27001 vs SOC 2).

Meet the people behind these projects in the Philippines

Every compliance project we deliver is led by a Sterling consultant — not a helpdesk queue. Our implementation team is based across the country, in Metro Manila, Cebu and Davao, so gap assessments, training days and audit-week support happen at your site, whether you operate in Luzon, the Visayas or Mindanao.

Talk to the expert nearest you: book a free compliance consultation → — we work on-site in Metro Manila, Cebu, Davao and nationwide.

Related guides: SOC 1 vs SOC 2 · ISO 27017 · ISO 27018 · HIPAA · PCI DSS · SOC reports overview