What is the difference between SOC 1 and SOC 2?

SOC 1 covers a service organization's controls that are likely relevant to its customers' internal control over financial reporting, and is written for those customers and their auditors. SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality and privacy, and is used for vendor risk management.

What is the difference between SOC 2 Type 1 and Type 2?

A Type 1 report gives an opinion on the system description and the design of controls as of a specified date. A Type 2 adds an opinion on whether the controls operated effectively throughout a specified period, so it gives more assurance.

Is SOC 3 the same as SOC 2?

It covers the same trust services areas but with less detail, and it's a general-use report that can be freely distributed. SOC 2 reports are restricted to parties who understand the system, such as customers and their CPAs.

Is SOC 2 a certification?

No. It's an attestation report issued by an independent CPA. In the United States, a licensed CPA performs SOC 2 examinations under the AICPA's attestation standards.

Is security required in a SOC 2?

Management chooses which trust services categories are in scope. AICPA staff say most service organizations include security, and that even a SOC 2 covering only availability should include all the common criteria.

How long is a SOC 2 report good for?

A Type 2 report describes a specific past period, so its value fades as that period recedes. Ask for the most recent report, and a bridge letter from the vendor's management covering the time since the period ended.

SOC 1 vs SOC 2 vs SOC 3, and Type 1 vs Type 2, explained

SOC reports are how a vendor shows its controls have been examined by an independent CPA. SOC 1 is about controls that affect a customer's financial reporting; SOC 2 is about security, availability, processing integrity, confidentiality and privacy; SOC 3 is a shorter SOC 2 for general use. Here's what each covers, the difference between Type 1 and Type 2, and what to check before you rely on one, using the AICPA's own descriptions.

Explainer. Updated October 15, 2026. By AI Accounting Vendors. 5-minute read.

Key points

SOC 1: Controls at a service organization likely to be relevant to its customers' internal control over financial reporting. Written for customers and their auditors.
SOC 2: Controls relevant to security, availability, processing integrity, confidentiality and privacy. The AICPA says these reports address users' vendor risk management needs.
SOC 3: Covers the same areas as SOC 2 with less detail, and can be freely distributed.
Type 1 vs Type 2: Type 1 covers the design of controls as of a date. Type 2 adds an opinion on whether they operated effectively throughout a period.

SOC 1, SOC 2 and SOC 3 compared

The AICPA describes System and Organization Controls (SOC) as "a suite of service offerings CPAs may provide in connection with system-level controls of a service organization or entity-level controls of other organizations." The three reports for service organizations differ in subject and audience:

SOC reports for service organizations, per the AICPA
Report	What it covers	Who it's for	Distribution	Types
SOC 1 (opens in a new tab)	Controls at a service organization likely to be relevant to user entities' internal control over financial reporting	Customers (user entities) and their financial statement auditors (user auditors)	Restricted to the service organization's management, user entities and user auditors	Type 1 and Type 2
SOC 2 (opens in a new tab)	Controls relevant to security, availability, processing integrity, confidentiality and privacy	Customers managing vendor risk, and others who understand the system	Generally restricted to the service organization's management, user entities, business partners, CPAs serving them, and regulators	Type 1 and Type 2
SOC 3 (opens in a new tab)	The same areas as SOC 2, without the same level of detail	General users	General use; can be freely distributed	No Type 1 equivalent

There is also SOC for Cybersecurity (opens in a new tab), in which a CPA reports on an organization's enterprise-wide cybersecurity risk management program. It isn't specific to services a vendor provides to you.

Type 1 vs Type 2

AICPA staff confirm that "there are type 1 and type 2 versions of both a SOC 1 and SOC 2 report," and no Type 1 equivalent for SOC 3 (AICPA staff FAQ (opens in a new tab)). The AICPA's Journal of Accountancy describes the difference (2016 article (opens in a new tab), written in SOC 1 terms):

Type 1 and Type 2 reports
	Type 1	Type 2
What the auditor gives an opinion on	The description of the system and the suitability of the design of its controls	The same, plus the operating effectiveness of the controls
Time covered	As of a specified date	Throughout a specified period
What it tells you	Controls were designed suitably on that date	Controls were designed suitably and operated effectively over the period

For vendor due diligence, a Type 2 report tells you more, because the auditor tested whether controls actually operated over time. If a vendor has only a Type 1, ask when its first Type 2 period will end.

The five trust services categories in a SOC 2

SOC 2 reports are measured against the AICPA's trust services criteria (opens in a new tab), set by its Assurance Services Executive Committee. There are five categories:

Security: Information and systems are protected against unauthorized access, unauthorized disclosure and damage that could compromise them.
Availability: Information and systems are available for operation and use to meet the entity's objectives.
Processing integrity: System processing is complete, valid, accurate, timely and authorized.
Confidentiality: Information designated as confidential is protected.
Privacy: Personal information is collected, used, retained, disclosed and disposed of to meet the entity's objectives.

The service organization's management chooses which categories are in scope. AICPA staff say that "for most service organizations, management will include the security category," and that even a SOC 2 on availability alone should include all the common criteria (AICPA staff FAQ (opens in a new tab)). For software holding client data, look for security and confidentiality at a minimum, and privacy if personal information is involved.

In the United States, a SOC 2 examination is performed by a licensed CPA under the AICPA's attestation standards. A SOC 2 is an attestation report, not a certification.

Which report do you need?

Matching the report to the question
Your situation	Ask for
You audit a client that relies on a payroll processor, AP outsourcer or similar service that affects its financial statements	The service organization's SOC 1 Type 2, covering the period you're auditing
Your firm is evaluating software, including AI tools, that will hold client data	A SOC 2 Type 2 covering security and confidentiality (and privacy if personal data is involved)
You want a quick, shareable assurance summary	A SOC 3, knowing it has less detail than the SOC 2
The vendor has only a Type 1	The Type 1, plus when its first Type 2 period ends

How to read a vendor's SOC 2 report

What to check in a SOC 2 report

Type and period. Type 2, and a period that ended recently. For the time since, ask the vendor for a bridge letter from its management.
Scope. Is the product you'll use, including its AI features, inside the system described?
Categories. Which of the five trust services categories are covered.
The opinion. Check whether the auditor's opinion is unmodified, and if it's modified, read the reasons given.
Exceptions. Read the test results for deviations and management's response to each.
Subservice organizations. See which providers, such as hosting or AI model providers, the report includes and which it carves out. For carved-out providers, ask for their own reports.
Complementary user entity controls (CUECs). Read the controls the report lists for customers to operate, such as managing your own users' access, and make sure you do.

SOC 2 among AI accounting tools

Each listing in this directory records whether the vendor states, on its own site or trust center, that it holds a SOC 2 report. Current counts:

SOC 2 status across the directory, from vendor statements (live count)
What the vendor states	Tools
Holds a SOC 2 Type II report	44
Holds a SOC 2 Type I report (Type II not stated)	2
Does not hold a SOC 2 report	0
No official statement found	26
Tools listed	72

A vendor's statement isn't the report. Ask for the report itself under NDA, and check the points above. The AI vendor questionnaire includes the SOC questions to send, and the directory can filter to tools that state a Type II report.

SOC 1 vs SOC 2: questions

What is the difference between SOC 1 and SOC 2?: SOC 1 covers a service organization's controls that are likely relevant to its customers' internal control over financial reporting, and is written for those customers and their auditors. SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality and privacy, and is used for vendor risk management.
What is the difference between SOC 2 Type 1 and Type 2?: A Type 1 report gives an opinion on the system description and the design of controls as of a specified date. A Type 2 adds an opinion on whether the controls operated effectively throughout a specified period, so it gives more assurance.
Is SOC 3 the same as SOC 2?: It covers the same trust services areas but with less detail, and it's a general-use report that can be freely distributed. SOC 2 reports are restricted to parties who understand the system, such as customers and their CPAs.
Is SOC 2 a certification?: No. It's an attestation report issued by an independent CPA. In the United States, a licensed CPA performs SOC 2 examinations under the AICPA's attestation standards.
Is security required in a SOC 2?: Management chooses which trust services categories are in scope. AICPA staff say most service organizations include security, and that even a SOC 2 covering only availability should include all the common criteria.
How long is a SOC 2 report good for?: A Type 2 report describes a specific past period, so its value fades as that period recedes. Ask for the most recent report, and a bridge letter from the vendor's management covering the time since the period ended.

Sources

Official documents read on October 15, 2026. Vendor facts are sourced on each listing.