SOC 2 vs SOC 1: what is the difference?
You have heard of SOC 2. Then someone says: “Wait, there is also SOC 1?” Yes. And they are fundamentally different. This article explains which one you need. Both reports are based on standards from the AICPA .
The short answer: SOC 1 is for service organisations that affect their clients’ financial reporting (payroll, invoicing). SOC 2 covers IT security and operational controls. For most tech companies, SOC 2 is relevant, not SOC 1. Still unsure? Also compare SOC 2 with ISO 27001.
If your clients are other businesses that use your service for their financial reporting (think of a payroll processor or invoicing platform), you need SOC 1. If you offer SaaS, cloud or IT services, you need SOC 2. Some companies need both.
What is SOC 1?
Full name: SOC 1 Report on Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting
Focus: Financial reporting controls
Purpose: If your service has an impact on your client’s financial statements, you must prove that your controls are correct so that your client can rely on their figures.
Standard: SSAE 18 (US) or ISAE 3402 (international)
Example: You are a payroll service provider. You process salaries for your clients. If you make a mistake (wrong amount, wrong timing), that has a direct impact on your client’s financial reporting (salaries are an expense on their P&L).
Your client’s accountant asks: “How do we know that your payroll processing is correct?” Answer: “Here is our SOC 1 report.”
What is SOC 2?
Full name: SOC 2 Report on Controls at a Service Organization Relevant to Trust Services Criteria
Focus: IT security, availability, processing integrity, confidentiality, privacy
Purpose: Proving that your IT controls are in order, data is secure, systems are available, and so on.
Standard: Trust Services Criteria (AICPA)
Example: You are a SaaS CRM platform. Clients store their customer data in your system. They ask: “Is our data safe? Is your system available? Can you not see our data?”
Answer: “Here is our SOC 2 Type II report.”
The 7 main differences between SOC 2 and SOC 1
| Aspect | SOC 1 | SOC 2 |
|---|---|---|
| Focus | Financial reporting controls | IT security and operational controls |
| Criteria | ICFR (Internal Control over Financial Reporting) | Trust Services Criteria (5 categories) |
| Relevant for | Services with a financial impact | Services with an IT/data/security focus |
| Typical users | Payroll, billing, transaction processing | SaaS, cloud, IT services, data centres |
| What is tested | Controls that affect financial accuracy | Security, availability, confidentiality, etc. |
| Auditor focus | Relevance to financial statements | IT general controls + application controls |
| Report users | Client’s auditors (usually) | Broad audience (procurement, compliance, customers) |
SOC 1 in detail
Who needs SOC 1?
In the Netherlands, clients usually ask for the international variant, ISAE 3402. For which Dutch service providers this applies, read who ISAE 3402 is for.
Payroll processors:
- ADP, Paychex, etc.
- You process salary payments, taxes, benefits
- Impact: salary expense, tax liabilities on client financial statements
Billing and invoicing platforms:
- You process billing for your clients
- You generate invoices and process payments
- Impact: revenue recognition, accounts receivable
Claims processing:
- Insurance claims, healthcare claims
- Impact: liabilities, expenses
Transaction processing:
- Payment processors (debit/credit card processing)
- Impact: revenue, cash flow
Fund administrators:
- Mutual funds, hedge funds
- Calculate the NAV (Net Asset Value)
- Impact: fund valuation
What is tested in SOC 1?
A worked example of a control objective with a control matrix is in the ISAE 3402 step-by-step plan.
Control objectives:
- Completeness: all transactions are processed
- Accuracy: transactions are processed correctly
- Validity: only authorised transactions are processed
- Timeliness: transactions are processed on time
Examples of controls:
- Reconciliation procedures (input vs output)
- Authorisation workflows (who may approve transactions)
- Error handling (what happens when a transaction fails)
- Exception reporting (transactions outside normal parameters)
Typical SOC 1 control: “Company reconciles daily transaction totals between input file and output file. Discrepancies are investigated and resolved within 24 hours. Reconciliation is reviewed and approved by supervisor.”
SOC 2 in detail
(This is covered in detail on other pages, summarised briefly here)
Who needs SOC 2?
SaaS companies: CRM, project management, collaboration tools, analytics platforms
Cloud providers: IaaS, PaaS, hosting, managed services
IT service providers: Managed security, NOC/SOC services, IT outsourcing
Data centres: Colocation, hosting facilities
What is tested in SOC 2?
Trust Services Criteria:
- Security: protection against unauthorised access
- Availability: system uptime and performance
- Processing Integrity: data is processed correctly
- Confidentiality: confidential information is protected
- Privacy: personal data is handled correctly
Typical SOC 2 control: “Multi-factor authentication is enforced on all production system access. Access is granted based on role. Quarterly access reviews are performed to verify appropriateness.”
Can you have both SOC 2 and SOC 1?
Yes, and some companies need both.
Example: Payment processor
You process credit card payments for e-commerce companies.
SOC 1: You need it because your transaction processing has a direct financial impact. Your clients’ revenue depends on your accuracy.
SOC 2: You also need it because you process credit card data (security), your system must be available (availability), and your clients want to know that their data is safe.
Example: Payroll + HRIS platform
You combine payroll processing with HR management.
SOC 1: For the payroll component (financial impact) SOC 2: For the HRIS component (employee data, security, privacy)
Integrated audit
You can have SOC 1 and SOC 2 carried out in one audit. Many controls overlap:
- Access management
- Change management
- Incident response
- Backup and recovery
The auditor tests these controls once and reports them in both reports.
Costs: SOC 1 + SOC 2 together is not twice as expensive. It is more like 1.3-1.5x because of the overlap. If SOC 2 alone costs €60k, SOC 1 + 2 together cost €80k-€90k.
Type 1 vs Type 2 (applies to both)
Both SOC 1 and SOC 2 have Type 1 and Type 2:
Type 1: Point in time (controls designed on date X) Type 2: Operational effectiveness over a period (3-12 months)
Enterprise clients usually want Type 2, for both types.
Decision tree: which one do you need?
Start here: what is your main service?
Scenario 1: You are a SaaS, cloud provider or IT services business → SOC 2 is relevant → SOC 1 probably not needed (unless you specifically do financial services)
Scenario 2: You process transactions, billing or payroll → SOC 1 is relevant → SOC 2 possibly too (if your IT system is itself sensitive)
Scenario 3: You are a payment processor, fund administrator or insurance claims processor → Both are probably needed
Ask your clients
The best way to determine which one you need: ask your (potential) clients.
Sales questionnaires or RFPs usually ask specifically:
- “Do you have SOC 1 Type II?” (if they are a financial service)
- “Do you have SOC 2 Type II?” (if they check IT/security compliance)
If 80% of your prospects ask for SOC 2, that is your answer. If they ask for SOC 1, you need that.
Cost comparison
SOC 1 audit: €20,000-€60,000 for Type II (mid-sized company)
SOC 2 audit: €30,000-€80,000 for Type II (mid-sized company)
SOC 1 + SOC 2 combined: €50,000-€110,000 (not exactly 2x, because of overlapping controls)
Lead time: Both: 6-15 months for Type II (the observation period is the same)
For what the costs of the European variant consist of, read ISAE 3402 costs and lead time.
Common confusion
”I thought SOC 1 was the first, and SOC 2 the upgrade?”
No. They are different frameworks for different purposes. Not “version 1” and “version 2”.
”Do I need SOC 1 first, then SOC 2?”
No. You choose what is relevant. Most tech companies skip SOC 1 entirely.
”Is SOC 2 better than SOC 1?”
Not “better”, just a different focus. If you are a payroll processor, your clients will want SOC 1. If you are SaaS, your clients will want SOC 2.
”Can I use SOC 2 instead of SOC 1?”
No. If your client’s auditor asks for SOC 1 (for their statutory audit), they will not accept SOC 2 as a replacement. They are different standards.
SOC 3: the public version
There is also SOC 3, which is a public (abridged) version of SOC 2. There is no equivalent for SOC 1.
SOC 3 is a general-use report without sensitive details. You may share it publicly. It has less detail than SOC 2, so enterprise clients often do not accept it for due diligence. But it is useful for marketing.
Summary
For 90% of tech companies: SOC 2
If you build SaaS, host in the cloud, offer IT services or process data without financial impact: SOC 2.
For financial services-related companies: SOC 1
If you do payroll, billing, transaction processing or fund administration: SOC 1 (possibly SOC 2 as well).
Not sure? Ask your top 10 prospects or clients which compliance they ask for. Follow their requirements.
More information
- What is SOC 2 – Complete SOC 2 introduction
- Step-by-step plan – The 12 steps
- Costs and timeline – Detailed costs
- Trust Services Criteria – The 5 pillars of SOC 2
- ISAE 3402 vs SOC 2 – The international counterparts of SOC 1 and SOC 2
- AICPA SOC Reporting – Official source