SOC 1 vs. SOC 2 | AICPA | Understanding the Key Differences & Similarities and What You Need to Know

Thanks largely in part to the launch of the American Institute of Certified Public Accountants' (AICPA) SOC framework, the SOC 1 vs. SOC 2 discussion is well under way.

SOC stands for "System and Organization Controls", which allows qualified practitioners (i.e., licensed and registered Certified Public Accountants) to issue SOC 1, SOC 2, and/or SOC 3 reports.

After the SSAE 16 standard (which is used for issuing SOC 1 reports, and has been replaced with SSAE 18) effectively replaced the longstanding SAS 70 auditing standard for reporting periods ending on or after June 15, 2011, there has been much debate regarding SOC 1 vs. SOC 2 – specifically, when are they applicable, what is the respective scope for each, and what similarities or differences do they each share.

System and Organization Control (SOC 1) reports are to be conducted in accordance with Statement on Standards for Attestation Engagements No. 18 (SSAE 18). This AICPA attestation standard was intended not only to replace SAS 70 and SSAE 16, but also to reincorporate the auditing process with the concept of internal controls over financial reporting, or ICFR.

The SOC framework places elevated importance on the ICFR component for service organization reporting, thus advocating service organizations to opt for SOC 1 if the organization has a true nexus with ICFR, such as those in the financial services industry.

One perk of the SOC framework is the flexibility it provides regarding reporting options. The SOC 2 framework was created for technology-based service organizations, such as data centers, I.T. managed services and software as a service (SaaS) vendors, to name a few.

Technically, the majority of service organizations which have sought SSAE 16 (and now SSAE 18) compliance in recent years could now opt for SOC 2 reporting, which uses the AT 101 professional standard to issue reports.

Within this framework is a comprehensive set of criteria known as the Trust Services Criteria (TSP) which are composed of the following five (5) sections:

• The security of a service organization' system.
• The availability of a service organization's system.
• The processing integrity of a service organization's system.
• The confidentiality of the information that the service organization's system processes or maintains for user entities.
• The privacy of personal information that the service organization collects, uses, retains, discloses, and disposes of for user entities.

AICPA Publications relating to each applicable SOC Framework:

• SOC 1: Statement on Standards for Attestation Engagements, "Reporting on Controls at a Service Organization" as published by the AICPA.
• SOC 2: Attestation Standards, Section 101 of the AICPA Codification Standards (AT Section 101). "Reporting on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (SOC 2)", as published by the AICPA.

Intended Subject Matter and Applicable Scope:

• SOC 1: Internal Controls over Financial Reporting (ICFR).
• SOC 2: Controls at a service organization that are relevant to security, availability, processing integrity confidentiality, or privacy.

Intended Users of each Report:

• SOC 1: Auditors of the user organization's financial statements, management of the user organizations, and management of the service organization.
• SOC 2: Relevant parties that are knowledgeable about the services provided by the actual service organization.

To learn more about NDNB's SOC 1 SSAE 18 and SOC 2 reporting services and our competitive, fixed-fee pricing, contact Christopher G. Nickell, CPA. He can be contacted at 1-800-277-5415, ext. 706 or via email at This email address is being protected from spambots. You need JavaScript enabled to view it..