SOC 1 vs SOC 2 Reports for SaaS and Service Organizations

SOC 1 and SOC 2 examinations build trust for SaaS and service organizations by giving customers evidence about the risks they need covered. SOC 1 addresses controls relevant to customers’ financial statements, while SOC 2 addresses controls over data and systems. Choosing the right report, or both, makes that evidence useful to financial auditors and enterprise procurement teams rather than leaving their central questions unanswered.

What SOC reports are and why the SOC 1 / SOC 2 split is the first decision a service organization must make

System and Organization Controls is the AICPA’s reporting suite for service organizations. SOC 1 and SOC 2 flow from SSAE 18 and are issued by licensed CPA firms, but they answer different questions. Choosing between them is therefore a decision about scope.

SOC 1 operates under AT-C Section 320, SSAE No. 18, as amended, and internationally under ISAE 3402. SOC 2 operates under AT-C Sections 105 and 205, paired with the AICPA’s Trust Services Criteria, issued in 2017 with revised points of focus in 2022. The distinction starts with the service itself. Does it touch customers’ financial statements, their data and systems, or both?

What SOC 1 actually covers and which service organizations need it

SOC 1 covers controls over services that process or host transactions capable of flowing into a customer’s general ledger and affecting its audited financial statements. Its focus is internal control over financial reporting. The control objectives address whether transactions are authorized, complete, accurate, recorded in the right period, and reported correctly. They also cover the IT general controls on which those application controls depend.

A payroll processor makes the distinction concrete. Its objectives would address gross-to-net calculation accuracy, completeness of tax withholdings, and authorization of payment files. Management specifies those objectives around the service’s financial impact, so a payroll processor’s report differs from a fund administrator’s. Tailored scope connects the examination to the financial-statement assertions the customer’s auditor must evaluate.

That auditor is the report’s primary reader. SOC 1 is restricted-use, written for accountants deciding how much reliance to place on the service organization’s controls when auditing the customer. Payroll processors, benefits administrators, claims processors, loan servicers, fund administrators, transfer agents, and revenue cycle management firms are common candidates. A SaaS platform belongs in the same discussion when its output feeds a customer’s accounting system.

What SOC 2 actually covers and which service organizations need it

SOC 2 addresses a different source of customer risk. It covers controls relevant to the security, availability, processing integrity, confidentiality, and privacy of customer data and the systems handling it. Financial-statement impact is not the prerequisite here. A service can need SOC 2 even when none of the data it handles reaches a customer’s books.

The framework comes from the AICPA’s Trust Services Criteria. Every SOC 2 engagement must include Security, as set out in the common criteria. An organization can choose to add Availability, Processing Integrity, Confidentiality, and Privacy based on the commitments it has made to customers. An infrastructure host might add Availability, and an organization that handles sensitive personal data would add Confidentiality and Privacy. The 2022 revisions changed the points of focus to reflect changes in technologies, threats, privacy expectations, and data management concerns, but the criteria themselves stayed the same.

The audience changes with the purpose of the report. Security teams, vendor-risk functions, and procurement teams read SOC 2, and enterprise procurement routinely requires it before onboarding a technology vendor. Business continuity, vendor management, incident response, encryption, and privacy practices fit this data-protection inquiry rather than defining SOC 1’s financial-reporting purpose. For a SaaS company seeking enterprise deals, SOC 2 is both a step in its own compliance work and evidence that buyers require before they will buy.

How do you know which SOC report a customer is asking for?

The source of a request is the most reliable starting signal. A customer may ask only for “your SOC report,” leaving the intended scope unstated. Who is asking, and what risk needs covering? An audit team concerned with financial processing needs SOC 1, while procurement, information security, or vendor-risk teams concerned with data protection need SOC 2.

The practical mental test is whether incorrect output from the service could make the customer’s financial statements wrong.

A yes points to SOC 1, often with SOC 2 as well because the service also handles customer data. A no points toward SOC 2 for a data-protection request. This distinction prevents a common substitution error. A strong SOC 2 does not replace SOC 1 because it does not provide the financial-reporting control objectives the customer’s auditor needs, even when Processing Integrity is included.

SOC 3 is a public-facing summary with an auditor’s opinion, but without a detailed system description or control testing results. Enterprise buyers need more than the opinion alone. Procurement will still require SOC 2.

Why many service organizations need both reports, and how to manage that efficiently

A payroll SaaS platform illustrates why the answer is often both. Its calculations affect customers’ financial reporting, and its employee records hold sensitive information such as Social Security numbers and bank account details. A hosted general ledger or fund administrator with a client portal can face the same combination, making the examinations complementary.

Logical access, change management, computer operations, backup, and physical security appear as ITGC objectives in SOC 1 and under the common criteria in SOC 2. When control descriptions are written once and mapped to both frameworks, the same evidence can serve both engagements. Coordinated fieldwork and evidence collection reduce audit fatigue without collapsing the reports’ different purposes.

For a mid-sized organization, expense remains a legitimate objection. Scope discipline is the practical response. A first SOC 1 can focus tightly on services affecting financial reporting. SOC 2 can begin with Security and expand in later years as the program matures, with scope still grounded in customer commitments.

Why Type II is what enterprise buyers and external auditors actually require

The SOC 1 versus SOC 2 choice settles the subject of the examination, but not the period of assurance. Type I evaluates control design at a specified point in time. It does not establish whether controls worked over time. Type II tests operating effectiveness over a period, commonly spanning three months up to a year.

Most enterprise buyers and external auditors require Type II, and a Type I alone will not satisfy customer auditors’ testing requirements for regulatory compliance. Financial auditors need evidence relevant to the financial year. Selecting the right SOC framework but stopping at Type I can therefore leave the original request unresolved.

Type I nevertheless has a legitimate place in a first SOC program. It bridges the gap between establishing controls and demonstrating their performance over time. Customers should understand that Type I is an initial milestone and that Type II will follow.

How AI in financial workflows is changing what SOC examinations must address

AI introduces control questions into financial and operational workflows that the SOC frameworks were not originally designed to address. The governing distinction still applies to the affected service. AI used in financial reporting raises SOC 1 questions about processing accuracy and authorization, while AI handling customer data raises SOC 2 questions about security and confidentiality. Building or training a model is not the threshold for scrutiny.

The AICPA released Technical Q&A Section 9561 on September 11, 2026, addressing how a service organization’s AI use affects SOC 1 and SOC 2 examinations. The guidance applies to organizations using AI. The AICPA and the AI Underwriting Company announced a joint offering on October 19, 2026, combining SOC 2 with AIUC-1 certification of AI agents and platforms. A full launch was planned for early 2027.

Licensed CPA firms perform the SOC 2 and AIUC-1 engagement and issue the report, while AIUC performs required quarterly technical testing. AIUC-1 certification must be renewed each year, with testing at least every three months. The AIUC-1 part of the engagement tests the AI agent itself. It adds AI-specific governance and reliability requirements without changing the SOC 2 Trust Services Criteria.

Freddie Mac’s Bulletin 2025-16 added and amended Sections 1302.2 and 1302.8 of its Single-Family Seller/Servicer Guide, introducing AI and machine learning governance, audit, and security requirements effective March 3, 2026. Fannie Mae’s most recent seller/servicer letter requires disclosure, on request, of AI/ML types, purposes, uses, and safeguards. Service organizations must consider both what their SOC reports need to cover and the AI governance expectations that apply to their workflows.

How the SOC decision applies in specialized industries — mortgage banking, multifamily housing, and skilled nursing

Customers in regulated industries may have requirements that a standard vendor questionnaire misses. In mortgage banking, external auditors need assurance when a customer relies on a service organization for processes relevant to internal control over financial reporting. A loan servicer’s SOC 1 objectives address payment posting accuracy, escrow reconciliation, and investor reporting. These specific financial-processing questions require assurance distinct from a broad data-security assessment.

Without SOC 1 assurance, the burden shifts elsewhere. Each investor’s external auditor may need to go to the servicing facility or issue a scope limitation. That consequence explains why the report is more than a procurement preference.

For multifamily housing, the same decision framework starts with the service’s role. Does it affect a customer’s financial statements or handle a customer’s data? The scope must follow the requirements that apply to the customer, since housing-related services can need different reports. Knowledge of the industry helps determine what a service needs beyond what its label says.

Skilled nursing illustrates a related but distinct boundary. Owners pursuing a Section 232/LEAN refinance or streamlined 223(a)(7) need clean financials that comply with applicable accounting standards and a dependable annual reporting process. HUD 232 audit obligations are separate from SOC reporting. Misallocating interest paid at closing on a prior mortgage is a frequent first-time nursing home audit finding, illustrating the financial-data control failures a well-run SOC 1 environment at a relevant service organization is designed to prevent.

Applying the decision framework: a practical checklist for SaaS platforms and service organizations

For a practical decision, answer three questions in order. Does the service affect a customer’s financial statements, does it store or process customer data, and who is asking for assurance about which risk? If the service only affects financial reporting, it needs SOC 1 Type II. If the need is only for data security, SOC 2 Type II fits, with Security required and other criteria chosen based on the commitments made to customers. Both exposures point to coordinated SOC 1 and SOC 2 engagements sharing ITGC evidence.

If neither exposure is clear, start with the written request. The customer’s auditors or procurement team can define the assurance they need more precisely than an unexplained request for a SOC report. For a first-time program, set expectations that Type I will lead to Type II. Where AI affects financial reporting or customer data, factor in Section 9561 and check whether the joint AIUC-1 offering meets the governance expectations that apply.

Auditor selection should follow those scope decisions. Look for auditors who know the industry, give the work partner-level attention, and can collect and use evidence for SOC 1 and SOC 2 without duplicating effort. A payroll processor’s financial control objectives are not a loan servicer’s, and a skilled nursing software vendor needs more than generic SaaS assumptions. The strongest sales value comes from evidence that answers the buyer’s actual question, with the right scope and period of assurance.