Compliance Glossary

SOC reports, or Service Organization Control reports, are a type of assurance report that organizations can obtain to assure the controls they have in place related to a service they offer. There are 3 types of SOC reports – SOC 1, SOC 2, and SOC 3.

SOC 1 reports relate to controls relevant to user entities’ financial reporting. These reports are intended for use by user auditors as part of their audit of the user entity’s financial statements.

SOC 2 reports relate to controls relevant to a system’s security, availability, processing integrity, confidentiality, and privacy. These reports are intended for use by the service organization’s management and the user organization’s management.

SOC 3 reports are similar to SOC 2 reports, but they are intended for a general audience and do not include the detailed testing and results that are included in a SOC 2 report. SOC 3 reports are designed to ensure the controls are in a form that a general audience can easily understand.