SOC 1 Type II Report

Officially known as a “Report on Management’s Description of a Service Organization’s System and the Suitability of the Design and Operating Effectiveness of Controls,” the Type II report contains all the same information as the Type I report, but it adds in a different element. The Type II report addresses the design and testing of the controls over a period of time, which is most often six months, as opposed to the specific date used in a Type I report. It also describes the testing performed and the results. This type of report is far more rigorous and intensive than Type I, as it covers a greater span of time and requires that your auditors perform a more thorough investigation of your system’s design and processes.