Side-by-side comparison
| Dimension | SOC 1 | SOC 2 | SOC 3 |
|---|---|---|---|
| What it covers | Controls at a service organisation relevant to user entities' internal control over financial reporting. | Controls related to security, availability, processing integrity, confidentiality, or privacy (Trust Services Criteria). | Same scope as SOC 2 but in a summarised format. |
| Who uses it | User auditors performing financial statement audits and the user entity's management. | Management of the service organisation and its customers who need assurance over IT controls. | Anyone. SOC 3 is a general-use report, often published on the service provider's website. |
| Distribution | Restricted use. Available only to the service organisation and user entities (including their auditors). | Restricted use. Same restricted distribution as SOC 1. | General use. No distribution restrictions. |
| Type I and Type II | Yes. Type I covers design at a date. Type II covers design and operating effectiveness over a period. | Yes. Same distinction applies. | No. SOC 3 is always based on a Type II examination but omits detailed test descriptions. |
| Governing standard | AT-C 320 (US). International equivalent is ISAE 3402. | AT-C 205 (US). No direct international equivalent. | AT-C 205 (US). No direct international equivalent. |
Key Points
- SOC 1 is the only report type relevant to a financial statement audit because it covers controls over financial reporting.
- SOC 2 addresses IT security and operational controls, not financial reporting assertions.
- SOC 3 is a shortened, general-use version of SOC 2 with no detailed testing results.
- European auditors who receive a SOC 2 instead of a SOC 1 cannot use it as evidence under ISA 402.
When the distinction matters on an engagement
The distinction matters when a European audit client uses a US-based service provider and the service provider offers a SOC report. The question is always the same: does this report give me evidence I can use in a financial statement audit?
ISA 402.12 allows the user auditor to use a service auditor's report as audit evidence, but the report must address controls relevant to the user entity's financial reporting. A SOC 1 report does this. A SOC 2 does not, because the Trust Services Criteria address IT operational controls, not financial reporting assertions. A SOC 3 is even further removed because it omits detailed test results entirely.
The error is accepting a SOC 2 from a service provider and documenting it in the file as evidence of control effectiveness over financial reporting. It is not.
Worked example: Johansson Analytics AB
Client: Swedish data analytics company, FY2024, revenue €22M, IFRS reporter. Johansson uses three US-based service providers.
Provider 1: CloudPay Inc. (payroll processing, €3.1M payroll expense)
CloudPay provides a SOC 1 Type II report covering 1 January to 31 December 2024. The report addresses controls over payroll input validation and disbursement relevant to user entities' financial reporting.
Documentation note: "SOC 1 Type II report obtained from CloudPay Inc. Report covers controls relevant to financial reporting over the full audit period. Per ISA 402.12, report is acceptable as audit evidence for the completeness and accuracy of payroll expense. Assessed service auditor competence per ISA 402.13. No exceptions reported."
Provider 2: DataVault LLC (cloud hosting, €480K annual spend)
DataVault provides a SOC 2 Type II report covering the same period. The report addresses security and availability under the Trust Services Criteria.
Documentation note: "SOC 2 Type II report obtained from DataVault LLC. Report addresses Trust Services Criteria, not controls over financial reporting. Cannot be used as ISA 402 evidence for financial statement assertions. SOC 2 is noted for IT risk assessment context only. If reliance on DataVault's controls is needed for financial reporting purposes, a SOC 1 report must be requested or the user auditor must perform direct testing."
Provider 3: QuickSign Corp (digital signature platform, immaterial spend)
QuickSign publishes a SOC 3 report on its website.
Documentation note: "SOC 3 general-use report noted. No detailed test results available. Spend immaterial at €18K annual. No further procedures required."
If the team had used the SOC 2 report from DataVault as evidence supporting IT general controls over financial reporting, the file would misrepresent the scope of the evidence obtained.
What reviewers get wrong
The most frequent mistake is treating a SOC 2 report as interchangeable with a SOC 1 report. SOC 2 addresses Trust Services Criteria, not financial reporting controls. User auditors who document SOC 2 reports as ISA 402 evidence have relied on a report that does not address the relevant assertions.
When a US-based provider offers only a SOC 1 report (not an ISAE 3402 report), the user auditor must consider whether the AT-C 320 engagement was conducted at a standard equivalent to ISAE 3402. ISA 402.A20 addresses this. In practice, AT-C 320 and ISAE 3402 are closely aligned, but the user auditor should document the equivalence assessment rather than assuming it.
Key standard references
- AT-C 320: Governs SOC 1 reports. International equivalent is ISAE 3402.
- AT-C 205: Governs SOC 2 and SOC 3 reports. No direct international equivalent.
- ISA 402.12: Permits the user auditor to use a service auditor's report as audit evidence.
- ISA 402.A20: Addresses equivalence assessment when the report is prepared under a non-ISA framework.
Related terms
Related reading
Frequently asked questions
Can a SOC 2 report be used as evidence in a financial statement audit?
No. SOC 2 addresses the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy), not controls over financial reporting. ISA 402 requires evidence relevant to financial reporting assertions, which only a SOC 1 report provides.
What is the difference between SOC 2 and SOC 3?
SOC 2 and SOC 3 cover the same Trust Services Criteria, but SOC 2 is a restricted-use report with detailed test descriptions and results. SOC 3 is a general-use summary report, often published on the service provider's website, that omits the detailed testing information.