Type 1 or Type 2 decider
The two-step costs more in total than going straight to a Type 2. It is still the right call more often than people expect, and this works out which case you are in.
A Type 1 says your controls were designed properly on one date. A Type 2 says they operated properly across a period. Buyers want the second one, the second one takes at least three months longer, and paying for both in the same year costs more than paying for one. Which of those facts wins depends on whether a contract is waiting.
Five questions. The answer renders on this page and nothing is sent anywhere unless you ask for it at the end.
On its way
Check your inbox shortly. If you would rather talk it through, book a time.
What the two reports actually differ on
- Type 1
- An opinion on whether controls were suitably designed as of one date. No period, no sampling across time, no evidence of operation.
- Type 2
- An opinion on whether the same controls also operated effectively across a stated period, normally three to twelve months.
- Observation window
- The period a Type 2 covers. It cannot be shortened below what a buyer will accept, and it cannot be created after the fact.
- The two-step
- A Type 1 issued now, then a Type 2 covering a window that starts the day after. Two engagements, two fees, one continuous story for a buyer.
| What you are comparing | Type 1 | Type 2 |
|---|---|---|
| Audit fee | $12,000 to $30,000 | $20,000 to $60,000 |
| Time from ready to report | 3 to 7 weeks | Window plus 5 to 10 weeks |
| Shortest honest timeline from a standing start | About 4 months | About 7 months |
| What a security reviewer concludes | The design is sound, nothing about operation | The controls held up across a period |
| How long it stays useful | Until the Type 2 lands, and rarely twice | About twelve months from period end |
| Both in one year, audit fees only | $32,000 to $90,000 | |
The position this tool takes
Buy a Type 1 when a named contract is waiting and the window cannot finish in time. That is the only case where the extra fee buys something, and in that case it buys revenue, which makes it the cheapest money on the project.
Skip the Type 1 everywhere else. If no deal is blocked, a Type 1 is a report buyers half accept, that expires the moment the Type 2 exists, and that costs $12,000 to $30,000 CAD. Companies buy one anyway because it feels like progress. Progress is the window running, and the window runs whether or not you bought a Type 1.
One exception worth naming: a company whose controls are new sometimes gains from the Type 1 fieldwork itself, because an auditor walking the control set six months before the real examination finds design problems while they are still cheap to fix. That is a readiness argument rather than a sales one, and a gap assessment usually buys the same thing for less.
Common questions
Is a Type 1 worth doing at all?
Only when a specific contract is waiting on a report that a Type 2 cannot reach in time. In that case it converts a lost deal into a closed one for $12,000 to $30,000 CAD, which is easy arithmetic. With no deal blocked, the same money is better spent on readiness and the window.
Will buyers accept a Type 1 when they asked for a Type 2?
Frequently, once, with a dated commitment to the Type 2. Ask the question in writing and early. The answer comes from the buyer's security reviewer rather than the salesperson you are talking to, so leave time for it to travel.
Does a Type 1 shorten the Type 2 timeline?
No. The observation window is the same length either way. What a Type 1 does is give you something to hand over while that window runs, and confirm the control design before the auditor tests operation.
How much more does doing both cost?
The Type 1 fee is additional, so budget $12,000 to $30,000 CAD on top of the Type 2 for a company under 100 staff. Some firms discount the pair when both are engaged at the same time, and asking for that at the quote stage is normal rather than cheeky.
What if we already hold a Type 1 and the customer wants a Type 2?
Have the Type 2 period start the day after the Type 1 date. It is the cheapest shape, it produces an unbroken story for a reviewer, and it is what an audit firm will suggest anyway. The deadline back-calculator gives the date that lands on.
Get both priced before you choose
Ask Canadian CPA firms for a Type 1 fee, a Type 2 fee, and the pair together. The spread tells you plenty.
Get matched