3.2 Type 1 vs. Type 2 Examinations: Timing, Testing & Operating Effectiveness

🎯 Essential Technical Takeaways

• Type 1 reports evaluate only the suitability of control design as of a single point in time (does NOT test operating effectiveness).
• Type 2 reports evaluate control design AND test operating effectiveness throughout a specified period (typically 6-12 months).
• In Type 2 examinations, inquiry alone is NEVER sufficient; auditors must corroborate with observation, inspection, or reperformance.
• A Bridge Letter (Gap Letter) is signed by service organization management (NOT the CPA firm) to cover short interim reporting gaps.

Within both the SOC 1 and SOC 2 frameworks, service organizations can commission either a Type 1 or Type 2 examination: (1) Type 1 Examination: reports on management's description of the system and evaluates whether controls were suitably designed to achieve stated objectives 'as of a specific point in time' (e.g., as of June 30). The service auditor performs walkthroughs to confirm design, but performs zero testing of operating effectiveness over time; (2) Type 2 Examination: reports on management's description, evaluates suitability of design, AND tests the 'operating effectiveness' of controls 'throughout a specified period' (typically a minimum of 6 months, up to 12 months).

In financial statement audits and vendor risk reviews, external auditors require Type 2 reports. A Type 1 report cannot be relied upon to reduce control risk below maximum because it provides no evidence that controls actually functioned consistently over time. In a Type 2 examination, the service auditor applies a strict hierarchy of audit procedures: Inquiry, Observation, Inspection of documentary evidence, and independent Reperformance. Under AICPA attestation standards (AT-C 205.28), inquiry alone is explicitly prohibited from serving as sufficient appropriate evidence of operating effectiveness.

When a user entity's fiscal year-end does not align with the end of the SOC report testing period (e.g., SOC report ends September 30, but client fiscal year ends December 31), management requests a 'Bridge Letter' (or Gap Letter). The Bridge Letter is a formal representation signed by service organization executive management certifying that no material changes or control failures have occurred during the intervening three-month gap. The CPA firm does not sign the bridge letter.

⚠️ CPA Evolution Exam Traps & Control Pitfalls

• Assuming a Type 1 report can be relied upon by external auditors to reduce control risk below maximum.
• Relying on inquiry alone as sufficient evidence to test operating effectiveness in a Type 2 report.
• Believing the independent CPA firm signs the interim bridge letter (management signs it).