SOC 1 vs SOC 2 vs SOC 3: The Canadian Buyer's Breakdown

Your buyer's procurement team just replied with one line. Please send your SOC report.

No letter, no number, no date range. The whole problem with SOC 1 vs SOC 2 vs SOC 3 starts right there, because the three names look like a ranking and they are not one. They are three different reports answering three different questions, and a Canadian company can spend a quarter and a five figure invoice on the wrong one before anybody notices.

Most founders meet these reports exactly the way you just did. A deal moves into security review, a form appears, and a document nobody on the team has ever read is suddenly sitting between you and the contract.

Here is the part people get wrong. The number is not a level. It is a subject.

What a SOC report is before you pick a number

SOC stands for System and Organization Controls. The American Institute of Certified Public Accountants describes the SOC suite of services as offerings CPAs may provide in connection with system level controls, producing assurance reports that help users assess the risks of outsourcing a service to somebody else.

Two things follow from that sentence, and both of them surprise people.

The first is that a SOC report is an accountant's product. A licensed CPA firm plans it, tests it, and signs it. Software does not produce it, and neither does a consultancy without the licence.

The second is that you do not pass or fail. There is no certificate and no score. The auditor writes an opinion, and if controls did not operate the way management described them, that shows up as an exception inside the report your customer then reads. A report with a handful of well explained exceptions is normal. A report nobody will show you is the warning sign.

SOC 1 vs SOC 2: the difference is subject matter, not seniority

A SOC 1 report is about money. The AICPA defines the SOC 1 engagement as an examination of controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting, and it names the intended readers plainly: the companies that use your service, and the CPAs who audit those companies' financial statements.

Read that audience list again, because it is the whole test. A SOC 1 exists so that your customer's financial auditor does not have to come and audit you. If your software touches a number that ends up in somebody else's financial statements, that auditor has a problem, and a SOC 1 is how you solve it for them.

A SOC 2 report is about the data. It is examined against the trust services criteria, and the AICPA's 2017 Trust Services Criteria, established by its Assurance Services Executive Committee, names the five categories as Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the one everybody includes. The other four are scoping decisions, and every one you add lengthens the engagement.

So the buyer's real question is never which report is more advanced. It is whose problem needs solving: your customer's auditor, or your customer's security team.

The practical test takes about thirty seconds. Does your product move, calculate, or hold a figure that lands in your customer's books? Payroll processing, billing and invoicing, claims adjudication, order to cash, fund administration, benefits administration. That is SOC 1 territory. Does your product mainly hold their data and their users? That is SOC 2 territory.

Plenty of companies genuinely need both, and they are not redundant. A payroll platform is a financial process to the customer's controller and a data custodian to the customer's CISO. Those are two audiences with two questions, and one report will not satisfy the other one.

Where SOC 3 actually fits

SOC 3 confuses people because it looks like the next step up from SOC 2. It is closer to the opposite.

The AICPA's SOC 3 page says SOC 3 reports address controls relevant to security, availability, processing integrity, confidentiality and privacy, that they do not provide the same level of detail as a SOC 2, and that they are considered general use reports which can be freely distributed.

That last clause is the entire point of it. A SOC 2 report contains the auditor's testing detail, the system description, and any exceptions, so it normally goes out under a non disclosure agreement to a named recipient. A SOC 3 strips the detail down to something you can put behind a link on your website with no gatekeeping at all.

Which means SOC 3 is not a cheaper alternative to SOC 2. It is a summary of the same underlying work, produced for people you are never going to sign an NDA with. If a vendor offers you a SOC 3 and refuses the SOC 2, ask why.

The Canadian wrinkle almost nobody mentions

Here is where Canadian companies get caught, and it is not covered on any of the American pages above.

SOC is AICPA terminology. Canada has its own assurance standard. Chartered Professional Accountants of British Columbia, in its FAQ on reports on controls at service organizations, explains that CSAE 3416 covers reasonable assurance engagements by a service auditor reporting on controls at organizations that serve user entities, and states that a SOC 1 report is largely similar to a CSAE 3416 report. The same guidance notes that Canadian standards do not currently include reports specifically similar to SOC 2 or SOC 3, and that an engagement under CSAE 3000 could accomplish the same thing. It also notes that a practitioner needs audit category public practice licensing to perform these engagements.

Read that carefully, because it explains a conversation that trips up Canadian founders every year. Your American buyer's procurement portal has a checkbox that says SOC 2. Your Canadian accountant quotes you a CSAE 3000 engagement. Both parties think they are talking about the same thing, and the checkbox does not have a field for CSAE 3000.

The fix is boring and it works. Ask the buyer, in writing, whether they need the AICPA branded SOC 2 report specifically or whether an equivalent third party assurance report is acceptable. Then ask the CPA firm, also in writing, which standard they will issue under and whether they are set up to issue AICPA SOC reports. Some Canadian practices are, some are not, and finding out after you have signed the engagement letter is an expensive way to learn it.

Do this before you pick a firm, not after. Changing standards mid engagement means redoing scoping work you already paid for.

Type 1 and Type 2, in one paragraph

Both SOC 1 and SOC 2 come in two flavours, and this one genuinely is a sequence. A Type 1 looks at whether your controls are designed properly as of a single date. A Type 2 looks at whether they actually operated that way across a window of time, which means the auditor pulls samples and finds out whether the quarterly access review really happened in the quarter you said it did. Buyers who know what they are reading want the Type 2. The length of that observation window is something you and the CPA firm agree on, and it is the single biggest driver of when you can hand the report over.

Why the letter is rarely the actual problem

Teams spend weeks arguing about which report to buy. Almost nobody fails there. They fail at the evidence.

When the auditor arrives, the questions are relentlessly specific. Show me every person who had production access in March. Show me the ticket where that change was approved and by whom. Show me that the offboarding checklist was completed for the developer who left in February. Show me the log, not the policy that says you keep logs.

That is where a well run company and a badly run one separate, and the gap has almost nothing to do with whether the cover page says 1, 2, or 3. Most teams have the controls. What they cannot do is produce twelve months of proof on demand without three people dropping everything for two weeks.

A SOC report is also not the end of your obligations in Canada. The Office of the Privacy Commissioner of Canada explains that PIPEDA applies to private sector organizations that collect, use or disclose personal information in the course of a commercial activity, and sets out ten fair information principles, safeguards among them. No auditor's opinion discharges that. A SOC 2 gets you through procurement. PIPEDA is the law you are living under regardless.

If part of what you sell is an AI feature, the same evidence question shows up wearing different vocabulary, and buyers are starting to ask it in the same questionnaires. Our sister brand SecuritAI covers that side of the work.

Being straight about our role here. We are not an auditor and we do not issue SOC reports. A licensed CPA firm does that, and it should stay that way. What we build is the software that has your evidence in order long before anyone shows up to test it.

What to do this week

• Ask the buyer which report they need and what they will accept, in writing, before you price anything.
• Run the thirty second test. If your product touches your customer's books, scope a SOC 1. If it holds their data, scope a SOC 2 with Security and add categories only where a contract demands them.
• Ask candidate CPA firms which standard they issue under, AICPA or CSAE, and get it in the engagement letter.
• Pick your Type 2 observation window backwards from the deal you are trying to close.
• Before any of that, find out whether you can actually produce evidence for the last quarter. That answer decides your timeline more than the auditor does.

If you want the control by control version of step five, our SOC 2 compliance guide for Canadian companies walks through what an auditor asks for, and the readiness checklists in our resource library are the short form you can hand to your team today. If you would rather see how the evidence side works in practice, book a walkthrough and we will show you the platform against your own framework.

Frequently asked questions

Is SOC 2 better than SOC 1?

Neither one is better, because they answer different questions. SOC 1 covers controls relevant to your customer's internal control over financial reporting, and SOC 2 covers controls against the trust services criteria such as security and availability. A payroll platform may genuinely need both. Asking which is better is like asking whether a fire inspection beats an electrical inspection.

Do Canadian companies need a SOC 2 report or a CSAE 3000 report?

It depends entirely on who is asking. CPABC guidance notes that Canadian standards do not currently include a report specifically similar to SOC 2, and that a CSAE 3000 engagement could accomplish the same purpose. If your buyer's procurement system has a literal SOC 2 checkbox, confirm in writing whether an equivalent assurance report is acceptable before you engage a firm.

Can I skip SOC 2 and just get a SOC 3?

No. The AICPA describes SOC 3 as a general use report that does not carry the same level of detail as a SOC 2. It is a publishable summary of the same underlying examination work, not a shortcut around it, and a security reviewer who knows the difference will ask for the SOC 2 anyway.

Does a SOC 2 report make us PIPEDA compliant?

No. PIPEDA applies to organizations that collect, use or disclose personal information in the course of commercial activity, and it sets out ten fair information principles including safeguards. A SOC 2 report is an auditor's opinion about the controls you chose to put in scope. The two overlap, and evidence gathered for one helps with the other, but neither replaces the other.

How long does a SOC 2 Type 2 take?

The calendar is driven by two things you control and one you do not. You choose the observation window with the CPA firm, and you decide how much readiness work happens before it starts. What you do not control is how long it takes your team to produce evidence for a period that has already passed, which is where most delays actually come from.

References

• AICPA and CIMA, System and Organization Controls: SOC Suite of Services
• AICPA and CIMA, SOC 1: SOC for Service Organizations, ICFR
• AICPA and CIMA, SOC 3: SOC for Service Organizations, Trust Services Criteria for General Use Report
• AICPA and CIMA, 2017 Trust Services Criteria with Revised Points of Focus 2022
• Chartered Professional Accountants of British Columbia, Reports on Controls at Service Organizations FAQs
• Office of the Privacy Commissioner of Canada, PIPEDA in brief