Audit & assurance
SOC 2 Type 1 or Type 2: start with the decision your customer needs to make
A practical way to frame the report conversation around intended users, system boundaries, evidence and timing—before selecting labels or dates.
Begin with the intended user
Ask who is requesting assurance, what decision they are trying to make and which services they need to understand. Customer, investor, procurement and governance requests can look similar at first but may create different expectations around scope and timing.
A productive first conversation captures the request itself, any contract language, the people who will rely on the report and the deadline they are working toward. This avoids treating a generic checklist as the starting point.
Define the system before the controls
A useful system boundary explains the service, commitments, relevant people, technology, data, locations and third parties connected to the service being described. Control discussions become clearer once management can explain what is actually inside that boundary.
The boundary should be owned by management. An assurance team can ask questions and identify information gaps, but management remains responsible for the system description, the controls it operates and the evidence it provides.
Plan evidence as an operating rhythm
Evidence is easier to assess when it is created as part of the ordinary control activity. Identify the control owner, trigger, record, review point and retention location for each relevant activity before the reporting period becomes urgent.
A simple evidence calendar helps distinguish records that exist today from records that need an operating history. It also surfaces dependencies on vendors, access rights, approvals and management review.
Choose the next step with the facts visible
A readiness review, a Type 1 discussion and a Type 2 discussion serve different purposes. The appropriate path depends on the service, the selected criteria, intended users, management readiness and the engagement requirements agreed with the practitioner.
This article is general information. It does not determine report type, scope or outcome for a particular organisation. Obtain advice based on the actual service, contracts, systems and evidence available.
Continue reading
More practical perspectives.
Audit & assurance
SOC 2 readiness: build an evidence plan before you need it
A practical, non-technical way to organise ownership, controls and evidence before a SOC 2 examination begins.
Read articleAudit & assurance
Financial statement audit readiness: a management-owned plan before the request list arrives
A practical framework for management teams preparing records, responsibilities, schedules and explanations before a financial statement audit begins.
Read articleAudit & assurance
Customer due diligence: prepare the controls and evidence behind the security questionnaire
A practical operating framework for SaaS and technology teams responding to customer security, risk and assurance questions without turning every questionnaire into a one-off project.
Read articleContinue with the service
If a customer has already asked for a report.
SOC 2 audit
Type 1, Type 2, and the criteria an examination can cover.
ExploreSOC 2 for startups
A customer-trust path sized to an early team.
ExploreISO readiness
AT&F helps with readiness and preparation for the certification audit. An accredited certification body issues the certificate, not AT&F.
ExploreImportant note
This article is general information and may not reflect the latest standards, law or your specific circumstances. It is not audit, tax, legal, investment or other professional advice. Obtain advice before acting.