Reviewed November 9, 2026. The original publication date is retained.
A SOC 1 Type 1 report addresses management’s description of a service organization’s system and the suitability of the design of its controls as of a specified date. That date may be earlier than the date the auditor issues the report.
SOC 1 focuses on controls relevant to customers’ internal control over financial reporting. For example, a payroll processor’s controls over authorized changes and payroll calculations may matter to a customer’s financial statements. See the AICPA SOC 1 overview.
What Does Type 1 Tell a Customer?
The description concerns the system designed and implemented at the specified date. A Type 1 examination does not provide an opinion on operating effectiveness throughout a period. A Type 2 examination adds that period-based assessment.
Example Scenario: A customer receives a Type 1 report as of September 30, issued in November. The customer should evaluate the September 30 scope and date rather than assuming the report covers control operation through November.
Type 1 can answer a useful question about the system at a date. Whether it meets a customer’s needs depends on the request and intended use; it is not a compulsory preliminary step before Type 2.
What Does Management Prepare?
Management prepares two key documents:
- System description: Explain the service and the controls relevant to customers’ financial reporting.
- Written assertion: State management’s position on the description and the design of the controls.
Management also provides evidence for the examination. The independent auditor performs the examination and issues the auditor’s report. These are separate responsibilities.
The auditor determines appropriate procedures based on the engagement and evidence. There is no universal rule that every control is examined using exactly one sample. The AICPA discussion of SOC engagement quality explains the distinction between evaluating controls at a date and over a period.
Before agreeing to a report, confirm:
- Which service will be covered?
- What date will the Type 1 report address?
- Who will use the report?
- What does the customer need to learn from it?
Our SOC preparation checklist can help organize that discussion.