SOC 1 vs SOC 2 in Canada: CSAE 3416, CSAE 3000 and what your clients actually need

Service organizations in Canada are often asked for “a SOC report” without being told which one. Payroll processors, payment service providers, hosting companies, claims administrators and call centres all receive these requests. Getting the type right avoids paying for a report that does not answer your client’s question.

The short version

• SOC 1 covers controls at a service organization that are relevant to user entities’ internal control over financial reporting. Its main readers are your clients’ finance teams and their external auditors.
• SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality and privacy. Its main readers are your clients’ security, risk and procurement teams.

Both descriptions come from FRAS Canada’s non-authoritative guidance on SOC engagements, which also sets out the Canadian standards that apply.

How the Canadian standards line up

The labels SOC 1, SOC 2 and SOC 3 come from the AICPA’s SOC for Service Organizations suite. In Canada, practitioners perform these engagements under Canadian assurance standards:

• SOC 1: CSAE 3416, Reporting on Controls at a Service Organization, together with CSAE 3000. The CPABC FAQ on reports on controls at service organizations notes that a SOC 1 report is largely similar to a CSAE 3416 report.
• SOC 2 and SOC 3: CSAE 3000 alone, according to the FRAS Canada guidance. CPA Canada also publishes a SOC 2 guide adapted to Canadian standards.

The same FRAS Canada guidance notes that SOC engagements do not permit limited assurance reports, so only reasonable assurance applies.

Type 1 or Type 2?

Both SOC 1 and SOC 2 come in two forms. As the CPABC FAQ describes for CSAE 3416, a Type 1 report addresses the design of controls as of a specific date, while a Type 2 report addresses design and operating effectiveness over a period.

A Type 1 is useful as a first step or when a client needs something quickly. Most auditors and risk teams will eventually ask for a Type 2, because it shows that controls actually worked over time.

Which one do your clients need?

Choose SOC 1 when

• Your service directly affects your clients’ financial records: payroll, payment processing, billing, investment administration, transaction processing.
• Your clients’ external auditors are asking. Under CAS 402, which the CPABC FAQ identifies as the related auditing standard, user auditors consider controls at service organizations, and a SOC 1 report is the evidence they typically rely on.

Choose SOC 2 when

• Clients are asking about data protection, uptime or confidentiality rather than accounting.
• The request comes from security questionnaires, vendor-risk reviews or procurement.
• You host or process sensitive data but do not drive your clients’ financial figures.

Consider both when

A payment service provider or a fintech platform may need both: SOC 1 for clients’ auditors, SOC 2 for their security teams. Many controls overlap, especially IT general controls such as access, change management and operations, so the work can be planned together.

Do not forget complementary controls

Every SOC report describes controls your clients must operate themselves, often called complementary user entity controls. If a client does not review its own user access in your platform, your report cannot cover that gap. Write these clearly and make sure your onboarding materials repeat them.

Preparing for a first report

1. Confirm with two or three key clients which report they need and why.
2. Define the system boundary: services, locations, infrastructure and subservice organizations.
3. Write control objectives (SOC 1) or map to the criteria (SOC 2), then run a readiness assessment against them.
4. Fix gaps before the period starts, and collect evidence consistently throughout it.

How we can help: Ubitrak runs SOC 1 and SOC 2 readiness work and coordinates with partner CPA firms that issue the reports, while Accel GRC organizes controls and evidence. See our SOC 2 page, our financial audit offering, sample documents, or contact us.

Sources

• FRAS Canada – Non-authoritative guidance on SOC engagements
• CPABC – Reports on controls at service organizations FAQs
• CPA Canada – SOC 2 guide
• AICPA & CIMA – SOC for Service Organizations overview