Get a Type 1 first if a deal needs something this quarter and your controls are newly built. Go straight to Type 2 if buyers explicitly require it, or if your controls have already been running for a while. The difference is simple: Type 1 covers design at a point in time, Type 2 covers operation over a period.
What is the actual difference?
The AICPA Trust Services Criteria text explains it. A Type 2 SOC 2 engagement covers a period and includes an opinion on the operating effectiveness of controls, with the auditor's tests and results. A Type 1 engagement addresses the same subject matter, but the report does not contain an opinion on operating effectiveness. It speaks to whether controls are suitably designed as of a date.
Both use the same criteria. The Security category, with its Common Criteria, is part of every SOC 2. Availability, Confidentiality, Processing Integrity and Privacy are optional additions. The report comes from an independent CPA firm, and nobody can promise its content in advance.
How do you decide? Walk the tree.
Question 1: Does a signed or pending deal name Type 2 as a requirement?
- Yes: plan for Type 2. If the date is close, ask the buyer whether a Type 1 plus a dated plan for Type 2 is acceptable as a bridge. Get their answer in writing.
- No: go to question 2.
Question 2: Have the controls already been operating for several months, with evidence?
- Yes: Type 2 may be within reach. Agree the period start with your auditor and begin.
- No: go to question 3.
Question 3: Do buyers just need to see a report soon, and are they happy to see a design review?
- Yes: Type 1 first. It forces you to build controls, document them and pass an independent design review, and it gives you something to share.
- No, they want assurance of operation: go to question 4.
Question 4: Can you wait for a period to elapse?
- Yes: skip Type 1 and run Type 2. This avoids paying for two audits.
- No: Type 1 now, Type 2 period starting immediately after, so the clocks overlap.
Question 5 (check): Is your system stable? If you are about to replatform, change identity providers or rework infrastructure, wait until after, or define scope narrowly. A control set that changes mid-period makes testing messy.
What does each path cost in effort?
I did not find authoritative published prices or durations, so none are given here. Ask two or three audit firms for quotes and typical period lengths, and ask how they treat a Type 1 followed by a Type 2.
The effort differs in kind. Type 1 effort is front loaded: scope, policies, control design, tooling. Type 2 adds a long tail: running the controls on schedule and keeping evidence for every sample the auditor may draw, such as access reviews, change approvals, vendor reviews and incident exercises.
What mistakes do founders make?
- Treating Type 1 as a lighter Type 2. It answers a different question. Some buyers accept it as a first step, others do not.
- Starting the Type 2 period before controls work. Any control that fails during the period can produce an exception in the report.
- Over scoping. Add categories you need, not ones that sound good. Each adds criteria and evidence.
- Choosing by price alone. Check whether the firm is used to companies of your size and whether buyers in your market recognise it.
- Skipping the question to buyers. Ask what they accept. It often settles the decision.
- No owner for evidence. Operation over time needs a named person per recurring control.
What does a sensible timeline look like?
- Month 0: decide scope and categories, choose the firm, pick tooling.
- Next weeks: build policies and controls, fix gaps.
- Type 1 date: auditor assesses design as of a chosen date.
- Immediately after: start the Type 2 period, running every control on its cadence.
- End of period: auditor tests samples and issues the report.
- After that: repeat annually so the report stays current.
Dates are for you to set with the firm. Do not copy a number from a blog.
What to do
- Ask your top five deals or buyers which report they accept.
- Run the decision tree above and write down the answer and the reason.
- Choose scope and categories narrowly.
- Get quotes from at least two firms and ask about the Type 1 then Type 2 path.
- Assign an owner for each recurring control.
- Start evidence collection on day one, even if you are targeting Type 1.
- Set the Type 2 period start date and put it in the plan.
Quick check
Does a Type 1 report say your controls work?
No. It addresses whether controls are suitably designed as of a date and contains no opinion on operating effectiveness. A Type 2 report adds that opinion over a period.
Is Security required in every SOC 2?
Yes. The Security category is part of every SOC 2 report. Other categories are optional.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, which saves time whichever report you choose. Because the Type 2 clock matters once controls run, technical evidence from your real code and dependencies, scans, SBOMs and reachability, helps you see early what will pass. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. An independent CPA firm issues the report.
Open the framework mapping demo or book a call.
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022), introduction describing Type 1 and Type 2 engagements. Paraphrased, copyright AICPA.
Last reviewed: 18 October 2026.
