SOC REPORTS · CHOOSING ONE
The question has a false premise. Only two of the three are a choice. The third is a way of publishing one of them.
TL;DR
SOC 1 and SOC 2 are the real choice, and the subject matter decides it. SOC 1 covers controls that touch your customers’ financial reporting. SOC 2 covers controls against the Trust Services Criteria. SOC 3 is not a third audit. It is a short, public version of the same SOC 2 examination, with the test results taken out. You do not pick SOC 2 or SOC 3. You get a SOC 2 and then decide whether to publish a SOC 3 as well.
Sources: AICPA, SOC 3 · Linford & Co, SOC 2 vs SOC 3
The question contains two mistakes #
Almost every comparison lines the three up as equals and asks you to pick one. That framing gets two things wrong, and both of them cost real money.
SOC 3 is not a third kind of audit #
A SOC 3 comes out of a SOC 2 examination. Same criteria, same auditor, same testing. The auditor then writes a second, shorter report. It drops the system detail and the test results, and you may hand it to anyone. Buying a SOC 3 without a SOC 2 makes no sense, because the work is the same either way.
The SOC family has five members, not three #
The AICPA suite also holds SOC for Cybersecurity and SOC for Supply Chain. The first covers an entity’s whole cybersecurity risk management programme. The second covers a production, manufacturing or distribution system. Neither fits the “vs” framing either. A buyer may ask for something that sounds like a SOC report and fits none of the first three. Ask which one they mean.
What trips people up
A buyer asking for “a SOC report” means SOC 2 Type 2 most of the time. A buyer whose auditor is asking means SOC 1. Those two requests come from different departments, arrive in different words, and lead to different engagements. Find out which one you are answering before you scope anything.
The real choice: SOC 1 or SOC 2 #
One question separates them. Does a customer’s financial statement auditor need to rely on your controls?
SOC 1 exists for your customer’s auditor #
The AICPA is direct about who a SOC 1 serves.
“SOC 1 is an examination of controls at a service organization that are likely to be relevant to user entities’ internal control over financial reporting.”
AICPAOn the subject matter of a SOC 1 report
The AICPA goes further and names the readers. A SOC 1 meets the needs of the entities that use your service and “the CPAs that audit the user entities’ financial statements”. That second group is the point. A SOC 1 is a working paper for somebody else’s audit.
So the trigger is not your industry. It is whether your service moves numbers that land in a customer’s financial statements. Payroll processing, payment processing, loan servicing and claims administration tend to qualify. A project management tool does not, however large your customers are.
SOC 2 exists for your customer’s security team #
A SOC 2 reports against the Trust Services Criteria. Security is mandatory. Availability, processing integrity, confidentiality and privacy are yours to add when they match what you sell. Nobody’s financial statements enter into it.
This is the report behind most vendor security reviews in North America, and the one a procurement team names in a contract. Our guide to what a SOC 2 report is covers the criteria in full. The difference between Type 1 and Type 2 covers the choice you make next.
Plenty of firms need both. A payroll platform sells to finance teams whose auditors want a SOC 1, and to IT teams whose security reviews want a SOC 2. Running both is normal. The control sets overlap, so the second report costs less than the first.
What a SOC 3 adds, and what it leaves out #
A SOC 3 is the same examination with a different reader in mind.
SOC 2 report
Goes to named recipients under an NDA.
SOC 3 report
Post it on your website if you want to.
One examination, two reports. The SOC 3 drops what a public reader has no business seeing.
A CPA firm that issues both is blunt about the economics. The two reports cost about the same to perform, because the criteria demand the same testing either way.
“you rarely see a service organization with only a SOC 3 report and not a SOC 2 report.”
Linford & CoCPA firm, on running a SOC 2 and SOC 3 together
Two consequences follow. A SOC 3 on its own buys you nothing, because the expensive part is the testing and you pay for that either way. And a SOC 3 costs little once you have committed to the SOC 2. Ask your auditor to quote both at scoping rather than coming back later.
One more rule worth knowing. A SOC 3 only exists as a Type 2. No Type 1 version exists. A report you hand to the public has to say the controls worked over a period. Looking right on one date is not enough.
What good looks like
A SOC 2 Type 2 for the buyers who sign NDAs. A SOC 3 on your trust page for everyone who has not. The SOC 3 answers the first question in a security review before a salesperson has to.
The three compared #
Same auditor, same profession, three different jobs.
| Dimension | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| Subject matter | Controls relevant to customers’ internal control over financial reporting | Controls against the Trust Services Criteria, security always in scope | The same criteria as the SOC 2 it comes from |
| Who reads it | Customers and the CPAs who audit their financial statements | Customer security, risk and procurement teams | Anyone. Prospects, press, the open web |
| Contains test results | Yes, in a Type 2 | Yes, in a Type 2 | No. Opinion and assertion only |
| Type 1 available | Yes | Yes | No. Type 2 only |
| Distribution | Restricted use | Restricted use | General use |
| Governing section | AT-C 320 | AT-C 205, as amended | AT-C 205, as amended |
Which standard governs, and why “SSAE 18” is not quite right #
Most comparisons still say all three run under SSAE 18. That was true and it is now incomplete.
SSAE No. 21 took effect for practitioners’ reports dated on or after 15 June 2022. It replaced AT-C section 205 with a new version. That version carries a new title, “Assertion-Based Examination Engagements”. The change marks it off from AT-C section 206, which covers direct examinations. SOC 2 and SOC 3 sit under the revised AT-C 205. SOC 1 stays under AT-C 320.
Here is the honest part, and it matters more than the correction. Nothing about your SOC 2 changed. The CPA firms that perform these examinations describe SSAE No. 21 as new terminology and clarified concepts, with no substantive change to SOC 2 reports or the audits behind them. Your auditor still requests a written assertion from management. Your evidence requests look the same.
So why raise it? Because a page citing SSAE 18 as the current standard tells a sharp reader the author stopped checking in 2022. Cite AT-C 320 for SOC 1 and AT-C 205 as amended for SOC 2 and SOC 3, and you are right either way.
How to choose, in three questions #
- Does a customer’s financial statement auditor want assurance about your controls? If yes, you need a SOC 1. Ask the customer to put the request in writing, because this one almost always comes from their audit, not from them.
- Do customers run security reviews on you? If yes, you need a SOC 2. Start with security only, and add availability, confidentiality, processing integrity or privacy when a contract names them.
- Do you want a public answer to “are you SOC 2 compliant”? If yes, add a SOC 3 to the same engagement. If your sales cycle runs on NDAs anyway, skip it.
On cost and calendar, the numbers you need live in the SOC 2 work, not in the choice between report types. Our breakdown of what a SOC 2 Type 2 report costs and our SOC 2 Type 2 timeline cover both. The short version. The observation period runs 3 to 12 months, the AICPA sets no minimum, and three months is the practical floor.
One cross-border note, because it comes up in both directions. Every SOC report comes from a licensed CPA firm, and a Canadian firm can issue any of them. CPA Canada publishes its own SOC 2 guide. A report from a Toronto firm carries the same weight with a buyer in Chicago. Check the currency on the quote, because most published SOC prices are US dollars.
Frequently asked questions #
Do I need SOC 1 and SOC 2, or just one?
Most firms need one. You need both when your service moves money into customers’ books and holds their data. That is common in payroll, payments and benefits administration. The control sets overlap, so the second report costs less than the first.
Is SOC 3 better than SOC 2?
No, and they are not competing. A SOC 3 holds less than a SOC 2, not more. It drops the controls tested and the detailed results, which is what lets you publish it. A security reviewer who reads your SOC 3 will still ask for the SOC 2.
Can I get a SOC 3 without a SOC 2?
In practice, no. The examination behind both is the same, so the testing cost is the same. A firm holding only a SOC 3 is rare. Ask your auditor to quote both at scoping and take the SOC 2 as well.
Is there a SOC 3 Type 1?
No. A SOC 3 only exists as a Type 2. A general use report has to say the controls operated across a period, so the point-in-time form has no place here.
Can I put my SOC 2 report on my website?
No. A SOC 1 and a SOC 2 carry restricted use and go to named recipients, most often under an NDA. The SOC 3 is the general use version, and that is the one you may post.
Is SSAE 18 still the standard for SOC reports?
Not as a complete answer. SSAE No. 21 replaced AT-C section 205 for reports dated on or after 15 June 2022 and renamed it Assertion-Based Examination Engagements. SOC 2 and SOC 3 fall under that revised section, SOC 1 under AT-C 320. Nothing substantive changed in how the audits run.
Are there other SOC reports besides 1, 2 and 3?
Yes. The AICPA suite also holds SOC for Cybersecurity and SOC for Supply Chain. One covers an entity’s cybersecurity risk management programme. The other covers a production, manufacturing or distribution system. Ask which one a buyer means when the request does not match the first three.
Key takeaways #
- The real choice is SOC 1 or SOC 2, and the subject matter decides it.
- SOC 1 serves your customer’s financial statement auditor. SOC 2 serves their security team.
- SOC 3 is a general use version of your SOC 2, from the same examination, with the test results removed.
- A SOC 3 only exists as a Type 2, and buying one without a SOC 2 wastes the work.
- SOC 1 and SOC 2 carry restricted use. Only the SOC 3 goes on your website.
- Cite AT-C 320 for SOC 1 and AT-C 205 as amended for SOC 2 and SOC 3. “SSAE 18” is incomplete after 15 June 2022.
- The suite has five members. SOC for Cybersecurity and SOC for Supply Chain exist too.
Not sure which report your buyer is asking for? #
We read the contract clause, scope the right examination, and run it with a named compliance manager. Same process whether you sell in Toronto, Chicago or both.
