For a SOC 2 Type 1 audit date, have evidence that each control in scope is designed and in place on that day: approved policies, a risk assessment, system descriptions, configuration exports, access lists, vendor reports and an incident plan. A Type 1 report gives no opinion on how controls operated over time.
What does a Type 1 audit test?
A Type 1 report describes the design of controls at a point in time, per the AICPA text, and the auditor gives no opinion on operating effectiveness. A Type 2 report covers a period and includes tests of operating effectiveness. So on the audit date the question is whether each control exists and is set up correctly. You still need real artefacts, because the auditor inspects them. The criteria referenced below are from the 2017 Trust Services Criteria with 2022 points of focus, and the list is paraphrased.
What evidence maps to which criteria?
Governance, CC1 and CC2. Code of conduct with acknowledgment, organisation chart and role descriptions, board or leadership oversight minutes, background check procedure, security policy set with approval dates, and how security objectives are communicated to staff and customers (CC2.2 and CC2.3).
Risk, CC3 and CC4. A dated risk assessment covering fraud considerations and changes (CC3.2 to CC3.4), the risk register with owners, and the plan for monitoring controls (CC4.1).
Control activities, CC5. A control matrix mapping each risk to a control, and the policies behind them (CC5.1 to CC5.3), including those over technology (CC5.2).
Access, CC6. The asset inventory and data flow diagram (CC6.1), identity provider settings showing multi-factor authentication, a user list with roles for production systems, onboarding and offboarding procedure with a sample ticket (CC6.2 and CC6.3), physical access approach for offices or reliance on the cloud provider's report (CC6.4), data disposal procedure (CC6.5), firewall and network rules (CC6.6), encryption configuration and transport settings (CC6.7), and malware protection or equivalent (CC6.8).
Operations, CC7. Logging and alerting configuration, vulnerability scanning setup and sample report (CC7.1), monitoring for anomalies (CC7.2), incident response plan with severity levels and roles (CC7.3 to CC7.5), and a tabletop exercise note if you have one.
Change management, CC8. The change procedure, repository settings showing required review and protected branches, and a sample change from ticket to release.
Risk mitigation and vendors, CC9. Business continuity or insurance statement (CC9.1), vendor list with risk tier, and the latest assurance reports or questionnaires for critical vendors (CC9.2).
Additional categories. If Availability is in scope: capacity monitoring, backup configuration, and a recovery plan (A1.1 to A1.3). If Confidentiality is in scope: confidential information inventory and disposal rules (C1.1 and C1.2).
How should you package it?
Organise a shared folder by criteria number. For each item, add a short note saying what it proves and the date. Exports should show system names and timestamps. Keep a one page index so your auditor can find each artefact in under a minute.
What else should be ready on the day?
The system description draft, with services, infrastructure, software, people, data, procedures and boundaries. Names of people who can walk the auditor through each area. A list of known gaps and the plan to close them, since honesty here avoids surprises.
What mistakes are common?
- Policies approved last week with no acknowledgment from staff.
- A user list that includes former employees.
- Configuration screenshots with no date or system name.
- A vendor list without the reports you claim to hold.
- Evidence for one environment when the system runs in three.
What to do
- Confirm the criteria and categories in scope with your auditor.
- Create the folder by criteria number and the index.
- Collect each item above, with date and system name visible.
- Have a second person sample ten items for gaps.
- Fix gaps and re-export evidence close to the audit date.
- Prepare walk through owners for each area.
Quick check
Do I need months of logs for a Type 1 report?
No. A Type 1 report covers design at a point in time. Months of history matter for a Type 2 report, which covers a period.
What is the quickest way to fail a Type 1 audit?
Describing controls in your documents that are not set up in the systems on the audit date.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and the folder stays current rather than being rebuilt before every audit. Technical rows, such as vulnerability scans, dependency inventories and change records, come from your real code and dependencies through scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard does not replace the auditor, who is independent. Safeguard helps you prepare and keep evidence ready. Book a call to see it.
Sources
- AICPA 2017 Trust Services Criteria with 2022 points of focus, criteria CC1 to CC9, A1 and C1, read from the AICPA publication
Last reviewed: 18 October 2026.
