# Difference Between Soc 1 and Soc 2 Author: Nex Virox Team (Editorial Team) Reviewed by: Varshal Nirbhavane Published: 2026-09-01 Last updated: 2026-09-01 Canonical: https://nexvirox.com/difference-between/difference-between-soc-1-and-soc-2/ **Quick answer:** The main difference between Soc 1 and Soc 2 is that Soc 1 focuses on controls relevant to financial reporting, while Soc 2 focuses on controls relevant to security, availability, processing integrity, confidentiality, and privacy. Soc 1 is a report on internal controls over financial reporting, while Soc 2 is a report on operational controls over security, availability, processing integrity, confidentiality, and privacy.

Difference Between Soc 1 and Soc 2: Comparison Table

Aspect	Soc 1	Soc 2
Definition	Reports on controls relevant to financial statement accuracy for user entities.	Reports on controls relevant to security, availability, processing integrity, confidentiality, or privacy.
Primary Purpose	Assesses internal control over financial reporting (ICFR) for user organizations' audits.	Assesses operational controls for service providers to give assurance on non-financial criteria.
Core Mechanism	Focuses on controls that could materially affect user entities' financial statements.	Focuses on controls meeting defined Trust Services Criteria (TSC) categories.
Report Type	Type 1 reports design suitability at a specific point in time.	Type 1 reports design suitability at a specific point in time.
Report Type 2	Type 2 includes operating effectiveness testing over a defined period, typically 6-12 months.	Type 2 includes operating effectiveness testing over a defined period, typically 6-12 months.
Applicable Framework	Uses COSO Internal Control – Integrated Framework for financial reporting.	Uses AICPA Trust Services Criteria (TSC) framework for operational areas.
Trust Services Criteria	Does not use TSC; relies on COSO components and financial reporting principles.	Uses TSC categories: security, availability, processing integrity, confidentiality, and privacy.
Intended Users	User entities' auditors, CFOs, and financial statement preparers.	User entities' management, customers, regulators, and business partners.
Regulatory Driver	Often required by user entities under Sarbanes-Oxley (SOX) Section 404.	Often required by enterprise customers, industry regulations, or contractual agreements.
Report Structure	Includes management assertion, service auditor opinion, and control descriptions.	Includes management assertion, service auditor opinion, control descriptions, and TSC mapping.
Control Categories	Controls address financial reporting risks like revenue, cash, and inventory cycles.	Controls address operational risks like access management, encryption, and incident response.
Testing Scope	Tests controls over financial transactions, journal entries, and account balances.	Tests controls over system operations, data integrity, and security configurations.
Common Use Cases	Used by payroll processors, loan servicers, and financial data providers.	Used by SaaS companies, cloud providers, data centers, and IT outsourcing firms.
Report Frequency	Typically issued annually or semi-annually depending on user needs.	Typically issued annually, with some providers offering quarterly updates.
Examination Period	Type 2 period usually spans 6 to 12 months of testing.	Type 2 period usually spans 6 to 12 months of testing.
Compliance Alignment	Aligns with financial audit requirements under SOX and similar regulations.	Aligns with security frameworks like NIST, ISO 27001, and HIPAA requirements.
Management Assertion	Assertion covers fair presentation of controls related to financial reporting.	Assertion covers fair presentation of controls related to TSC categories.
Auditor Independence	Requires independent CPA firm licensed in the jurisdiction of the service organization.	Requires independent CPA firm licensed in the jurisdiction of the service organization.
Report Distribution	Restricted to user entities' auditors and financial statement preparers.	Restricted to specified parties like customers, prospects, and regulators.
Subservice Providers	Includes carve-out or inclusive method for subservice providers affecting financial controls.	Includes carve-out or inclusive method for subservice providers affecting TSC controls.
Risk Assessment	Risk assessment focuses on material misstatement risks in financial statements.	Risk assessment focuses on risks to achieving TSC objectives like security breaches.
Control Environment	Evaluates entity-level controls like tone at the top and governance structures.	Evaluates entity-level controls like risk management and monitoring processes.
Information & Communication	Assesses financial reporting communication channels and information systems.	Assesses communication of security policies and incident notification procedures.
Monitoring Activities	Reviews ongoing monitoring of financial controls via internal audits and reviews.	Reviews ongoing monitoring of security controls via vulnerability scans and audits.
Complementary Controls	Identifies user entity controls needed for financial reporting completeness.	Identifies user entity controls needed for TSC objectives like access management.
Report Language	Includes opinion on whether controls are suitably designed to prevent material misstatements.	Includes opinion on whether controls are suitably designed to meet TSC.
Historical Context	Evolved from SAS 70 to SSAE 18 for financial reporting assurance.	Evolved from SAS 70 to SSAE 18 incorporating TSC for operational assurance.
Cost Range	Typical cost ranges from $15,000 to $50,000 depending on complexity.	Typical cost ranges from $20,000 to $80,000 depending on scope and TSC.
Preparation Time	Typically requires 3 to 6 months of preparation and testing.	Typically requires 4 to 8 months of preparation and testing.
Best-Fit Scenario	Best for organizations processing financial transactions for user entity audits.	Best for technology companies needing security and availability assurance for customers.

What Is Soc 1?

Soc 1 is a System and Organization Controls report that focuses on internal controls over financial reporting. It is designed for user entities and their auditors who need to assess the risk of material misstatement in financial statements.

Definition of Soc 1

Soc 1 is an independent auditor's report on a service organization's controls relevant to user entities' internal control over financial reporting. It follows the Statement on Standards for Attestation Engagements (SSAE) No. 18 and evaluates controls that could affect financial statement accuracy.

Key Characteristics of Soc 1

Characteristic	What It Means in Practice
Financial focus	Evaluates controls that impact user entities' financial statements and reporting accuracy.
SSAE 18 basis	Prepared under the AICPA's SSAE 18 standard, replacing the older SSAE 16 framework.
User auditor audience	Created for auditors of user organizations, not for general marketing or vendor assessment.
Two report types	Type 1 examines design at a point in time; Type 2 tests operating effectiveness over a period.
Control descriptions	Management provides a detailed narrative of controls, which the auditor independently validates.
Control testing	Type 2 reports include detailed tests of controls performed by the service auditor.
Bridge letters	Often supplemented with bridge letters to cover gaps between the reporting period and current date.
Subservice organizations	Requires disclosure of subservice organizations and whether carve-out or inclusive methods are used.
Management assertion	Includes a written assertion from service organization management about the fairness of the description.
Complimentary user controls	Lists controls that user organizations must implement for the service provider's controls to be effective.

Common Examples of Soc 1

Payroll processing firms – ADP and Paychex produce Soc 1 reports because payroll calculations directly feed client financial statements.
Healthcare claims administrators – Companies processing medical claims issue Soc 1 reports since claim payments affect client financial reserves.
Loan servicing platforms – Mortgage servicers like Mr. Cooper use Soc 1 to validate controls over borrower payment processing.
Trust and custody banks – State Street and BNY Mellon issue Soc 1 reports for asset safekeeping and transaction recording controls.
Insurance policy administrators – Third-party administrators managing policy billing and claims need Soc 1 for accurate premium reporting.
Investment fund administrators – Firms like SS&C Technologies report on controls over net asset value calculations and subscription processing.
Accounts payable processors – Companies handling invoice payment on behalf of clients require Soc 1 to verify payment authorization controls.
Employee benefit plan recordkeepers – Fidelity and Vanguard issue Soc 1 reports for 401(k) contribution and distribution processing.
Utility billing services – Municipal billing processors use Soc 1 to validate meter reading and invoice generation controls.
Tax preparation outsourcing – Offshore tax return preparation services provide Soc 1 to demonstrate controls over client tax data handling.

Advantages and Limitations of Soc 1

Advantages	Limitations
Reduces user auditor burden by providing independent testing of service organization controls.	Provides no assurance about the effectiveness of controls beyond the specified reporting period.
Helps service organizations avoid redundant, duplicative audits from multiple user auditors.	Offers no coverage of operational, security, or availability controls outside financial reporting scope.
Type 2 reports give practical evidence of control operation over a meaningful period of time.	Requires significant internal resources and management time to prepare descriptions and gather evidence.
Strengthens the overall control environment by forcing formal documentation of financial processes.	Does not certify the accuracy of financial statements themselves, only the controls surrounding them.
Facilitates smoother year-end audits for user organizations that rely on outsourced financial functions.	Fails to address cybersecurity or data privacy concerns, which are covered under Soc 2 instead.
Provides a competitive advantage when bidding for clients that require audited financial controls.	Findings and exceptions can be subjective, depending on the auditor's interpretation of control design.
Carve-out and inclusive methods offer flexibility in how subservice organizations are presented.	Report is confidential and cannot be shared publicly, limiting its usefulness for marketing purposes.
Helps identify control gaps early, allowing remediation before issues escalate into financial errors.	Costs can be substantial, especially for smaller service organizations with limited audit budgets.
Aligns with regulatory expectations for outsourced financial services in banking and insurance sectors.	Does not evaluate the quality or accuracy of the underlying data processed by the service organization.
Provides clear guidance on complementary user controls that must be implemented by the client.	May include exceptions that require user auditors to perform additional substantive testing anyway.

What Is Soc 2?

Soc 2 is a trust services report that evaluates a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy. It exists to give customers and stakeholders assurance that a vendor protects their data and systems.

Definition of Soc 2

Soc 2 is an attestation report issued by a CPA firm that examines whether a service organization's controls meet the AICPA's Trust Services Criteria, covering security, availability, processing integrity, confidentiality, and privacy. It provides assurance about data protection for cloud-based and SaaS providers.

Key Characteristics of Soc 2

Characteristic	What It Means in Practice
Trust Services Criteria	Auditors test controls against five predefined categories, including security, availability, and privacy.
Type 1 report	Evaluates whether controls are suitably designed at a single point in time, usually a specific date.
Type 2 report	Tests whether controls operate effectively over a period, typically 6 to 12 months of continuous observation.
CPA-issued	Only a licensed CPA firm can perform the audit and issue the official Soc 2 report.
Security category	Always included and covers access controls, monitoring, and protection against unauthorized access.
Customizable scope	Organizations can choose which additional criteria beyond security to include, such as privacy or confidentiality.
Management letter	Accompanies the report and describes any exceptions or control gaps the auditor found.
Continual monitoring	Requires ongoing oversight of controls, not just a one-time review, to maintain compliance.
Report distribution	Typically shared with customers, partners, and regulators who need assurance about data handling.
Renewal cycle	Reports are valid for a limited period, so organizations must re-audit regularly to stay current.

Common Examples of Soc 2

Salesforce – a leading CRM platform that holds Soc 2 reports to assure customers about data security and availability.
Amazon Web Services – a major cloud provider that undergoes Soc 2 audits to demonstrate robust infrastructure controls.
Dropbox – a file storage service that uses Soc 2 to verify its security and privacy controls for enterprise clients.
Slack – a team communication tool that maintains Soc 2 compliance to protect sensitive workplace data.
Zoom – a video conferencing platform that relies on Soc 2 to assure users about meeting data confidentiality.
Atlassian – a software company behind Jira and Confluence that holds Soc 2 reports for its cloud products.
Stripe – a payment processing platform that uses Soc 2 to demonstrate strong security controls for financial data.
Okta – an identity management provider that obtains Soc 2 to verify its access control and authentication systems.
HubSpot – a marketing and sales platform that maintains Soc 2 to reassure customers about data protection.
Twilio – a communications API provider that uses Soc 2 to prove its reliability and security for developers.

Advantages and Limitations of Soc 2

Advantages	Limitations
Builds customer trust by providing independent verification of data security controls.	Audits are costly and time-consuming, often requiring months of preparation and significant fees.
Helps win enterprise contracts where vendors must meet strict security requirements.	Only covers controls at a specific point or period, so it does not guarantee future security.
Provides a competitive edge over rivals that lack a Soc 2 report.	Does not assess the quality or accuracy of the service itself, only the controls around it.
Identifies control gaps through the auditor's findings and management letter.	Report is not publicly available, so customers must request it directly from the vendor.
Supports compliance with other frameworks like GDPR or ISO 27001.	Can be gamed by choosing a lenient auditor or limiting the scope to weaker criteria.

Similarities Between Soc 1 and Soc 2

Shared Aspect	How Soc 1 and Soc 2 Are Alike
Primary Purpose	Soc 1 and Soc 2 both provide independent assurance on a service organization's internal controls to build stakeholder trust.
Audit Framework	Soc 1 and Soc 2 are both based on the AICPA's SSAE 18 standard, defining the reporting requirements for service organizations.
Report Structure	Soc 1 and Soc 2 both produce a formal report with a service auditor's opinion on the design and operating effectiveness of controls.
Auditor Role	Soc 1 and Soc 2 both require an independent Certified Public Accountant (CPA) to perform the examination and issue the report.
Control Definition	Soc 1 and Soc 2 both require the service organization to define specific controls that address identified risks and objectives.
Testing Process	Soc 1 and Soc 2 both involve the auditor testing controls to verify they operate effectively during the audit period.
Evidence Collection	Soc 1 and Soc 2 both rely on documented evidence from the service organization to support the auditor's testing and conclusions.
Management Assertions	Soc 1 and Soc 2 both require management to provide a written assertion about the system's control effectiveness and completeness.
System Description	Soc 1 and Soc 2 both include a detailed system description that outlines the boundaries, processes, and components of the system.
User Entity	Soc 1 and Soc 2 both are designed to provide information to user entities, such as customers, who rely on the service organization's systems.
Annual Cycle	Soc 1 and Soc 2 both are typically performed on an annual basis to provide ongoing assurance that controls remain effective.
Preparatory Work	Soc 1 and Soc 2 both require significant preparation, including scoping, risk assessment, and control design before the audit begins.
Remediation Process	Soc 1 and Soc 2 both involve remediating any identified control deficiencies before the final report is issued to stakeholders.
Type I Option	Soc 1 and Soc 2 both offer a Type I report that evaluates the design of controls at a single point in time.
Type II Option	Soc 1 and Soc 2 both offer a Type II report that evaluates the operating effectiveness of controls over a period, typically 6-12 months.
Report Distribution	Soc 1 and Soc 2 both restrict report distribution to authorized parties, such as customers and regulators, to maintain confidentiality.
Cost Driver	Soc 1 and Soc 2 both have costs that vary based on system complexity, number of controls, and the chosen Type I or Type II format.
Audit Duration	Soc 1 and Soc 2 both require a time investment that can range from a few weeks to several months, depending on scope and readiness.
Risk Management	Soc 1 and Soc 2 both are used to identify and mitigate risks that could impact the reliability, security, or processing of customer data.
Compliance Value	Soc 1 and Soc 2 both help service organizations meet contractual, regulatory, or industry-specific compliance requirements from customers.
Vendor Oversight	Soc 1 and Soc 2 both are often requested by customers as part of their vendor due diligence and third-party risk management programs.
Control Documentation	Soc 1 and Soc 2 both require detailed documentation of control activities, including policies, procedures, and evidence of execution.
Audit Evidence	Soc 1 and Soc 2 both rely on a combination of inquiry, observation, and inspection of documents to gather sufficient audit evidence.
Reporting Language	Soc 1 and Soc 2 both use standardized language and terminology defined by the AICPA to ensure consistency across reports.
Control Testing	Soc 1 and Soc 2 both involve the auditor performing walkthroughs and sampling to test the operation of key controls.
Management Review	Soc 1 and Soc 2 both require management to review and approve the final report before it is distributed to stakeholders.
Continuous Improvement	Soc 1 and Soc 2 both drive service organizations to continuously improve their control environment and address emerging risks.
Long-Term Outcome	Soc 1 and Soc 2 both help build long-term customer trust, strengthen business relationships, and enhance market credibility.
Audit Log	Soc 1 and Soc 2 both require maintaining audit logs and records that demonstrate control operation and support future audits.

Soc 1 or Soc 2: Which Should You Choose?

The single variable that decides it for most organizations is who relies on the report. Choose Soc 1 when the report is for your financial statement auditors. Choose Soc 2 when your customers, prospects, or business partners require proof that your security controls are effective.

When to Use Soc 1

Choose Soc 1 when your services directly impact a user entity's financial statements. This applies to payroll processors, loan servicers, or SaaS platforms that handle transactions. Choose Soc 1 when your auditors need evidence of internal controls over financial reporting, and when your budget or timeline cannot support the broader operational scope of a Soc 2 audit.

When to Use Soc 2

Choose Soc 2 when your customers, prospects, or enterprise clients demand proof of your security posture. This applies to cloud infrastructure, data storage, and software providers whose clients have security review teams. Choose Soc 2 when you handle sensitive data like PII or protected health information, and when your sales cycle requires a trust report to close deals with large enterprises.

Common Misconceptions About Soc 1 and Soc 2

Common Myth	The Reality
Soc 1 and Soc 2 are interchangeable compliance reports.	Soc 1 covers financial reporting controls, while Soc 2 covers security, availability, processing integrity, confidentiality, and privacy controls.
Soc 2 is always stricter than Soc 1.	Soc 1 is stricter for financial statement accuracy, while Soc 2 is broader and more relevant for technology and data security risks.
You can pass a Soc 1 and Soc 2 audit simultaneously.	Soc 1 and Soc 2 audits have different control objectives, testing procedures, and reporting frameworks, so they require separate engagements.
Soc 1 is only for accounting firms.	Soc 1 applies to any service organization whose services affect a user entity's internal control over financial reporting, not just accountants.
Soc 2 is only for cloud providers.	Soc 2 applies to any service organization handling customer data, including data centers, SaaS companies, and IT managed service providers.
A Soc 1 report proves your financial statements are accurate.	Soc 1 reports describe controls relevant to financial reporting, but they do not opine on the actual accuracy of your financial statements.
A Soc 2 report proves your company is fully secure.	Soc 2 reports describe controls in place during a period, but they do not guarantee absolute security or prevent all security breaches.
Soc 1 and Soc 2 have the same audit testing procedures.	Soc 1 tests controls over financial reporting, while Soc 2 tests controls over the five Trust Service Criteria, which use different testing methods.
You need Soc 2 only if you store credit card data.	Soc 2 is relevant for any customer data, including PII, health data, and intellectual property, not just credit card information.
Soc 1 Type 1 and Soc 2 Type 1 are the same thing.	Soc 1 Type 1 evaluates design of financial controls, while Soc 2 Type 1 evaluates design of security, availability, and privacy controls.
Soc 2 automatically covers all five Trust Service Criteria.	Soc 2 audits can include one or more criteria, and many organizations choose only security, with availability, confidentiality, and privacy as optional.
Soc 1 is easier to pass than Soc 2.	Soc 1 requires deep financial reporting expertise, while Soc 2 requires broad operational and security controls, so difficulty depends on your organization's maturity.
You can use a Soc 1 report to answer a customer's security questionnaire.	Soc 1 reports do not address security, availability, or privacy controls, so customers asking about data protection need a Soc 2 report instead.
Soc 2 replaces the need for ISO 27001 certification.	Soc 2 is an attestation report, while ISO 27001 is a certification, and many organizations pursue both to satisfy different customer and regulatory requirements.
Soc 1 and Soc 2 reports are valid for one full year.	Soc 1 and Soc 2 reports cover a specific period, typically 6 to 12 months, and you must renew them annually to maintain current attestation status.
Soc 1 is more expensive than Soc 2.	Soc 2 audits often cost more because they involve more extensive testing across multiple criteria, but pricing varies by firm, scope, and organization size.
Soc 2 is legally required for all SaaS companies.	Soc 2 is not a legal requirement, but many enterprise customers and contracts demand it as a condition of doing business with a vendor.
Soc 1 and Soc 2 use the same control framework.	Soc 1 uses COSO for financial reporting controls, while Soc 2 uses the AICPA Trust Service Criteria for security, availability, and privacy controls.
A Soc 1 report is useful for a non-financial software product.	Soc 1 is rarely relevant for non-financial software, as it focuses on controls over financial reporting rather than product security or data protection.
Soc 2 guarantees your service will never go down.	Soc 2 availability criteria describe controls for uptime monitoring and incident response, but they do not guarantee zero downtime or uninterrupted service.
Soc 1 and Soc 2 audits can be performed by any consultant.	Only licensed CPA firms can issue Soc 1 and Soc 2 reports, and they must follow AICPA attestation standards and undergo peer review.
Soc 2 is the same as a penetration test.	Soc 2 is a controls audit over a period, while a penetration test is a point-in-time security assessment that actively attempts to exploit vulnerabilities.
Soc 1 reports are public documents anyone can access.	Soc 1 reports are confidential and distributed only to user entities and their auditors under a non-disclosure agreement, not published publicly.
Soc 2 Type 2 covers a longer period than Soc 1 Type 2.	Both Soc 1 Type 2 and Soc 2 Type 2 cover a minimum 6-month period, and the length is determined by the engagement scope, not the report type.
Soc 1 is outdated and no longer used by modern businesses.	Soc 1 remains essential for organizations providing services that affect financial reporting, including payroll, billing, and financial system providers.
Soc 2 is only about preventing data breaches.	Soc 2 covers security plus availability, processing integrity, confidentiality, and privacy, so it addresses operational risks beyond just breach prevention.
You can get a Soc 1 and Soc 2 report from the same audit in one document.	Soc 1 and Soc 2 are separate reports with different assertions, criteria, and intended users, so they cannot be combined into a single attestation document.
Soc 2 is required by law for healthcare or financial companies.	Soc 2 is not mandated by HIPAA or GLBA, but those regulations may require controls that a Soc 2 report can help demonstrate to customers and partners.
Soc 1 and Soc 2 have identical executive summary sections.	Soc 1 summaries focus on financial statement risks, while Soc 2 summaries focus on Trust Service Criteria, so the content and emphasis differ significantly.
Passing Soc 2 means you never need another security audit.	Soc 2 requires annual renewal, and continuous monitoring is expected, so passing once does not eliminate the need for future audits or ongoing vigilance.
Soc 1 is for internal use only, and Soc 2 is for external customers.	Both Soc 1 and Soc 2 reports are external documents, but Soc 1 targets user entity auditors, while Soc 2 targets customers, prospects, and business partners.

Conclusion

Difference Between Soc 1 and Soc 2 comes down to reporting scope: SOC 1 covers internal controls over financial reporting, while SOC 2 addresses security, availability, processing integrity, confidentiality, and privacy. Choose SOC 1 for financial audits; choose SOC 2 for trust services and data protection.

## FAQ ### What is the difference between SOC 1 and SOC 2? SOC 1 reports on internal controls over financial reporting, while SOC 2 evaluates controls related to security, availability, processing integrity, confidentiality, and privacy, making SOC 2 more relevant for technology and cloud service providers. ### Which is better for a SaaS company, SOC 1 or SOC 2? SOC 2 is better for SaaS companies because it directly addresses the security and privacy concerns of customers who store data in the cloud, whereas SOC 1 focuses narrowly on financial statement accuracy and is rarely requested by non-audit clients. ### What are the main differences in the trust criteria between SOC 1 and SOC 2? SOC 1 uses only the criteria related to financial reporting controls, while SOC 2 applies the AICPA Trust Services Criteria covering five areas: security, availability, processing integrity, confidentiality, and privacy, giving SOC 2 a broader operational risk scope. ### How much does a SOC 1 audit cost compared to a SOC 2 audit? A SOC 1 audit typically costs between $8,000 and $30,000, while a SOC 2 audit ranges from $10,000 to $50,000, with the final price depending on company size, control complexity, and the number of trust services criteria included. ### Is SOC 2 more difficult to pass than SOC 1? Yes, SOC 2 is generally more difficult because it requires implementing and evidencing controls across multiple trust criteria, whereas SOC 1 only needs controls tied to financial reporting, which often already exist in mature accounting departments. ### Can a company use a SOC 1 report to satisfy SOC 2 customer requirements? No, a SOC 1 report cannot satisfy SOC 2 customer requirements because it does not address the security, availability, or privacy controls that SOC 2 users expect, so you must obtain a separate SOC 2 examination to meet those contractual obligations. ### What are the typical use cases for SOC 1 versus SOC 2 reports? SOC 1 reports are used by user organizations' auditors to assess financial statement risks, while SOC 2 reports are used by customers, risk managers, and procurement teams to evaluate a service provider's security posture and operational resilience. ### Can I switch from a SOC 1 to a SOC 2 report without redoing the audit? You cannot switch from SOC 1 to SOC 2 without a new audit because the examination scope, control criteria, and testing procedures differ significantly, so you must engage your CPA firm for a separate SOC 2 engagement even if you recently completed SOC 1. ### What is the biggest mistake companies make when choosing between SOC 1 and SOC 2? The biggest mistake is assuming SOC 1 covers security controls, when in reality it only addresses financial reporting risks, leaving your customers unprotected and your business non-compliant with common cloud service provider requirements. ### Which report should a payroll processor obtain, SOC 1 or SOC 2? A payroll processor should obtain a SOC 1 report because its core function directly impacts clients' financial statements, though adding a SOC 2 report is recommended if the processor also offers cloud-based HR or benefits administration features.