SOC reports: what they are and why Canadian businesses need to care

SOC 1, SOC 2, and SOC 3 explained

The three types of SOC reports serve different purposes and different audiences. Understanding the distinction is essential when deciding which one your organization needs — or which one to request from a vendor.

SOC 1 — Internal Controls over Financial Reporting

SOC 1 reports (formerly SAS 70 reports) are specifically about controls at a service organization that are relevant to the financial reporting of user entities. If your organization processes transactions or manages data that affects your customers' financial statements — payroll processing, accounts payable outsourcing, data centre services for financial systems — a SOC 1 is relevant. The report is evaluated by the user entity's financial statement auditors, who rely on it to assess how the service organization's controls affect the user entity's internal controls over financial reporting.

SOC 1 reports are confidential documents, distributed only to the service organization's customers and their auditors. They are not meant for general marketing use.

SOC 2 — Trust Services Criteria

SOC 2 reports cover a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy — the five Trust Services Criteria. They are not specifically about financial reporting; instead, they address whether the service organization's systems and data are protected. SOC 2 has become the de facto standard for evaluating SaaS companies, cloud infrastructure providers, managed security services, and any other organization that processes sensitive customer data.

SOC 2 reports are also confidential, shared under non-disclosure agreements with prospective and existing customers during vendor due diligence.

SOC 3 — General Use Summary

SOC 3 is essentially a public-facing summary of a SOC 2 report. It covers the same criteria but presents only a high-level summary of the auditor's conclusions, without the detailed description of the service organization's system, controls, and test results. Because SOC 3 reports contain less sensitive information, they can be published on a company's website and used for general marketing purposes. If a company says "SOC 2 certified" on their website but provides only a SOC 3 report on request, that is technically correct — the SOC 3 is based on a full SOC 2 assessment.

SOC 2 Trust Services Criteria

The Trust Services Criteria (TSC) for SOC 2 were developed by the AICPA and define the principles and criteria against which the service organization's controls are assessed. There are five categories:

1. Security (required)

The Security criterion is the only one required in every SOC 2 report. It covers whether the system is protected against unauthorized access, use, or modification — both physical and logical. Controls include access management (user provisioning, multi-factor authentication, privileged access controls), vulnerability management, security monitoring, incident response, and network security. The Security criterion has the most extensive set of control requirements and is sometimes called the "Common Criteria" because it underpins all the other criteria.

2. Availability

Whether the system is available for operation and use as committed or agreed upon. Relevant controls include infrastructure redundancy, business continuity planning, backup and recovery procedures, and monitoring of system performance and uptime. Organizations that provide critical infrastructure or SaaS products with uptime SLAs typically include Availability in their SOC 2 scope.

3. Processing Integrity

Whether system processing is complete, valid, accurate, timely, and authorized. This criterion is most relevant to organizations that process transactions on behalf of customers — payment processors, data transformation services, and batch processing systems. Controls include input/output validation, error handling, and quality assurance procedures.

4. Confidentiality

Whether information designated as confidential is protected as committed or agreed. Relevant controls include data classification, encryption at rest and in transit, access controls to confidential data, and data handling procedures. Organizations that process commercially sensitive customer data — legal documents, financial records, health information (outside PIPEDA/HIPAA scope) — often include Confidentiality.

5. Privacy

How personal information is collected, used, retained, disclosed, and disposed of. This criterion aligns with principles from Canada's PIPEDA and provincial privacy legislation. It is most relevant to organizations that process significant volumes of personal data about individuals — HR service providers, health platforms, and consumer-facing applications. Privacy is the most complex TSC to address and often requires input from privacy lawyers as well as auditors.

Who needs SOC 2

SOC 2 reports are most commonly requested from, or required of:

• SaaS companies: Any company selling software-as-a-service to enterprise customers will likely face SOC 2 requirements in security questionnaires and procurement processes, particularly from customers in financial services, healthcare, and government.
• Cloud infrastructure and hosting providers: IaaS and PaaS providers (data centres, colocation facilities, cloud hosting) are regularly asked for SOC 2 reports by their customers whose own auditors need evidence of controls at the infrastructure level.
• Payroll processors: Companies that process payroll on behalf of other organizations typically need both SOC 1 (for the financial reporting implications) and SOC 2 (for security and confidentiality of employee data).
• Managed security service providers (MSSPs): SOC 2 is particularly relevant for cybersecurity service providers, given the security nature of their work.
• Data analytics and data management firms: Companies handling large volumes of customer data, including data warehousing, analytics, and AI/ML platforms, are increasingly required to provide SOC 2 reports.
• Accounting and professional services firms: Firms handling sensitive client financial information, particularly those providing outsourced accounting or tax services, may be asked for SOC 2 reports by their enterprise clients.

For Canadian companies selling into the US market, SOC 2 is essentially table stakes for enterprise sales. US enterprise procurement teams routinely require SOC 2 Type 2 reports as part of vendor security assessments.

Type 1 vs. Type 2 reports

Type 1 report

A Type 1 report provides an opinion on whether the service organization's system and controls are suitably designed to achieve the relevant criteria as of a specific point in time. It does not test whether the controls actually operated effectively over a period. Type 1 reports are faster and less expensive to obtain and are useful when a company is starting the SOC 2 process and wants an initial assessment of its control design. Some customers will accept a Type 1 report as a starting point, particularly if the company is newer.

Type 2 report

A Type 2 report covers both the design of controls and whether they operated effectively throughout a period (typically 6 to 12 months). It provides significantly more assurance than a Type 1 report. Most enterprise customers and security-conscious buyers require Type 2 reports, and for established companies a Type 1 alone is rarely sufficient for ongoing vendor due diligence. The observation period for a Type 2 is typically 6–12 months; 12-month periods are considered the gold standard.

CSAE 3416: the Canadian equivalent for service organizations

In Canada, the equivalent standard for service organization reporting is Canadian Standard on Assurance Engagements 3416 (CSAE 3416), issued by CPA Canada. CSAE 3416 is based on the International Standard on Assurance Engagements 3402 (ISAE 3402) and closely mirrors the SOC 1 framework from the AICPA.

CSAE 3416 specifically covers controls at a service organization that are relevant to user entities' internal control over financial reporting — the same scope as SOC 1. A CSAE 3416 report is the Canadian equivalent of a SOC 1 report: it provides assurance to the financial statement auditors of user entities about the controls at the service organization that affect the user entities' financial statements.

CSAE 3416 vs. SOC 2 in Canadian practice

While CSAE 3416 covers the financial reporting use case (like SOC 1), there is no direct Canadian equivalent to SOC 2. Canadian companies that need to demonstrate security, availability, and confidentiality controls typically obtain a SOC 2 report using the AICPA's Trust Services Criteria framework, conducted by a Canadian CPA firm that is licensed to perform SOC examinations. Many large Canadian accounting firms (Deloitte, KPMG, PwC, EY, BDO) perform SOC 2 engagements using AICPA standards.

For purely domestic engagements where the customer is a Canadian entity, some companies obtain a CSAE 3416 report for the financial reporting aspects and supplement it with other security assessments (ISO 27001 certification, penetration testing reports). For cross-border engagements or sales into the US market, SOC 2 is generally the standard that will be requested.

Typical timeline and cost

Phase 1: Readiness assessment (1–3 months)

Before the formal audit begins, most companies engage a CPA firm or a readiness consultant to assess their current controls against the SOC 2 criteria. The readiness assessment identifies gaps — controls that need to be designed or improved before the observation period begins. Rushing into a SOC 2 audit without a readiness assessment often results in a report with exceptions (control failures), which is far worse than a slightly delayed clean report.

Phase 2: Observation period (6–12 months)

The auditors observe whether the controls are operating effectively throughout the period. During this time, the company must consistently execute all documented controls — running user access reviews, performing change management procedures, monitoring security alerts, conducting vulnerability scans — and maintain evidence of each control execution. This is the period that requires the most ongoing discipline from the internal team.

Phase 3: Fieldwork and report (1–3 months)

After the observation period, auditors conduct their testing — reviewing control evidence, interviewing staff, and testing a sample of transactions. They then write the report, which includes a description of the service organization's system, management's assertion about the controls, and the auditor's opinion.

Cost ranges

SOC 2 costs vary widely based on the scope (how many criteria, the size and complexity of the system), the firm engaged, and how much internal preparation was done before the audit. Rough estimates for a first-year SOC 2 Type 2 engagement with a mid-sized firm:

Annual renewal audits (subsequent years) are typically 20–40% less expensive than the first year, as the framework is established and auditors are familiar with the company's systems.

Internal costs — staff time for control execution, evidence collection, and responding to auditor requests — can easily equal the external audit fees, particularly in the first year.