What You'll Practice
Our questions are aligned with the AICPA CPA Exam Blueprints, the authoritative guide for what's testable.
Common Traps to Avoid
These are the patterns that trip up candidates. Our questions specifically target these areas so you won't fall for them on exam day.
7-Day SOC Type Mastery Plan
Why Our Question Bank
Simple, Affordable Pricing
Pass the CPA exam for the price of a streaming subscription
Frequently Asked Questions
Type 2 adds operating effectiveness testing over a period (usually 6-12 months). Type 1 only covers design and implementation at a point in time. Type 2 provides more assurance because it shows controls actually worked over time, not just that they existed on one day.
The testing period is the timeframe over which the service auditor tested operating effectiveness of controls. It should cover a reasonable period (typically 6-12 months) and ideally align with or overlap the user entity's fiscal year for maximum relevance.
SOC 1 and SOC 2 reports are restricted-use reports intended for the service organization, user entities, and their auditors. They contain sensitive control information. SOC 3 reports are general-use and can be freely distributed, but contain less detail.
SOC reports describe control objectives (what the control should achieve) and the specific controls designed to meet those objectives. Type 2 reports also include test procedures performed and results. Users should map the control objectives to their own risks and requirements.