SOC 1 vs SOC 2 vs SOC 3: which report

Three reports, three audiences. Your customer almost certainly means SOC 2, but the exceptions are worth knowing before you commission the wrong engagement.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

SOC 1 reports on controls that affect a customer's financial statements. SOC 2 reports on security, availability, processing integrity, confidentiality and privacy. SOC 3 is a short public version of a SOC 2 with the test results stripped out. If a software buyer asked you for "a SOC report" without saying more, they mean a SOC 2 Type 2, and that is what you should scope.

The three reports side by side

Which one your customer actually wants

Ask them, then read what they wrote rather than what they said on the call. The words in the contract schedule are the ones that decide your scope.

1. Your buyer is a software company, a bank buying software, or an enterprise IT department. They want SOC 2 Type 2.
2. Your buyer's external auditor is asking, and your product touches payroll, billing, payments processing, claims adjudication or the general ledger. They want SOC 1, and they may want SOC 2 as well.
3. Your buyer will not sign an NDA and just wants something to file. SOC 3 satisfies them, and you can only produce one if you already did the SOC 2.
4. Nobody has asked and you are doing this pre-emptively. Do SOC 2 Security only, and read whether you need it yet before you spend anything.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

SOC 1, and when a Canadian company genuinely needs one

Your customer's auditor has to form an opinion on your customer's financial statements, and part of the process that produces those statements runs inside your systems. Rather than being audited twenty times for twenty customers, you get audited once and hand out the report.

The distinguishing feature is that you write the control objectives. There is no fixed criteria set, so a SOC 1 is only as useful as the objectives it names. Canadian firms perform SOC 1 engagements under the AICPA standards, and there is a parallel Canadian standard, CSAE 3416, that covers the same ground for Canadian user auditors. Ask which one your customer's auditor will accept before the engagement letter is signed. Reissuing under the other standard is a second engagement.

Products that usually trigger a SOC 1 request

Payroll and benefits administration

You calculate amounts that land in a customer's payroll expense.

Billing, invoicing and revenue recognition

Your system determines what the customer books as revenue.

Payment processing and treasury

Money moves through you and the movement is recorded from your data.

Claims, loans and lending servicing

You calculate balances the customer reports.

Expense management and procurement

Approvals in your system are the approval control the auditor tests.

If none of those describe you, a SOC 1 request is usually a procurement template written for a different kind of vendor. Push back once, in writing, and ask which financial statement assertion your system affects. That question resolves most misdirected SOC 1 requests.

SOC 3, and why almost nobody bothers

A SOC 3 is a general use report. It carries the auditor's opinion and a brief system description. It omits the control descriptions and test results, so it can be published without exposing your control design. Companies put the seal on a trust page and hand the file to anyone who asks.

It is cheap because it is a byproduct. If your auditor is already issuing a SOC 2 Type 2, adding a SOC 3 over the same period is a small incremental fee, in the $0 to $5,000 CAD range depending on the firm, and some include it. It is not a substitute. No security reviewer accepts a SOC 3 in place of a SOC 2: the part they need to read is the part a SOC 3 removes. It is a marketing asset and a way to answer early-stage prospects without an NDA.

When you need SOC 1 and SOC 2

Fintech and payments companies routinely need both, and the two engagements share a large amount of work. The system description, the change management controls, the access controls and the vendor management program are tested once and used in both reports. What does not overlap is the financial control objectives in the SOC 1 and the criteria-specific controls in the SOC 2.

If you think both are coming, say so in the request for proposal. The quote drivers page covers what else moves an audit fee, and the full cost page covers the three lines beyond the auditor.

Reports people confuse with these

SOC for Cybersecurity is a separate AICPA report aimed at boards and insurers rather than customers, and no software buyer has ever accepted it in place of a SOC 2. ISO 27001 is a certification against a management system standard, not an attestation, and it is what buyers in the UK and Europe usually ask for instead. The SOC 2 versus ISO 27001 page works through that decision for a Canadian company, and ISO27K covers it from the certification side.

Common questions