SOC 1 and SOC 2 audits allow service organizations to build trust and transparency through external verification of internal controls. Using AICPA-established criteria, multidisciplinary teams composed of licensed CPAs and information technology and security specialists perform the audit and provide reports relevant to security, availability, processing integrity, confidentiality, and privacy.
At a high level, the difference between SOC 1 and SOC 2 is that SOC 1 audits evaluate internal control over financial reporting. They are typically conducted on financial services providers such as accounting firms, banks, credit unions, financial management, and advisory services.
SOC 2 audits evaluate internal control over other types of data—data that does not influence financial reporting. SOC 2 audits are typically conducted on providers of other types of services, such as support services to the health care, legal, finance, and defense industries, as well as vendors to large tech corporations like Microsoft and Amazon.
Additionally, a SOC 3 general use report covers the same topics as the SOC 2 report but at a less detailed and specific level, intended for a general audience.