A Type 1 does not test whether controls operated over time, so there is no review period to wait through. Companies use it as a first report when a deal cannot wait for a Type 2, and normally follow it with a Type 2.
The Type I and Type II comparison covers when each one fits.
Read more
Related terms
- SOC 2 Type 2
- A SOC 2 Type 2 report gives an auditor's opinion on whether controls were suitably designed and operated effectively throughout a review period.
- Review period
- The review period is the window of time a SOC 2 Type 2 covers, over which the auditor tests whether controls operated effectively.
- SOC 2
- SOC 2 is an attestation report in which a CPA firm gives an opinion on a service organization's controls against the AICPA Trust Services Criteria.