What is a SOC readiness assessment?

A readiness assessment evaluates the proposed SOC scope, current controls, documentation, and available evidence before the formal examination begins. It helps management identify gaps and prioritize corrective action.

What is the difference between SOC 1 and SOC 2?

SOC 1 addresses controls relevant to user entities’ internal control over financial reporting. SOC 2 addresses controls relevant to security and any additional applicable Trust Services Criteria categories.

What is the difference between Type 1 and Type 2?

A Type 1 report addresses control design as of a specified date. A Type 2 report also addresses whether the controls operated effectively throughout a specified period.

How long does the SOC process take?

The timeline depends on the report type, scope, readiness of the control environment, availability of evidence, remediation needs, and—for a Type 2 report—the examination period. A readiness discussion allows us to develop a more meaningful timeline.

Can JConner perform both readiness and the SOC examination?

Readiness assistance and a subsequent examination may be possible when the services are structured to preserve independence and management retains responsibility for its controls, decisions, and implementation. The permitted scope should be evaluated before work begins.

What should we have available for the first discussion?

Helpful information includes the customer or contractual request, a description of the services provided, anticipated system boundaries, significant vendors or subservice organizations, existing policies, previous assessments, and the desired reporting timeline.

ChatGPT Image Jul 27, 2026, 09_34_03 PM.png

Schedule a SOC Consultation

Service Organizations

Independent SOC examinations, readiness assessments, and practical guidance for organizations pursuing SOC 1, SOC 2, SOC 3, SOC 2+, or specialized cybersecurity and supply-chain reporting.

Turn Control Requirements Into Business Confidence

Customers and enterprise prospects increasingly want assurance that service providers have appropriate controls over financial processing, security, availability, confidentiality, processing integrity, and privacy.

Whether your organization is preparing for its first SOC report or improving an established annual reporting process, JConner can help you determine the appropriate report, define a practical scope, assess readiness, organize supporting evidence, and complete an independent SOC examination.

Our goal is to provide a clear, well-managed path from the initial request to a defensible SOC report.

SOC Reporting Services

01 SOC Readiness

Scope definition, control design assessment, documentation review, gap identification, and prioritized remediation for organizations preparing for a SOC examination.

04 SOC 3 Reports

General-use SOC 3 reports addressing the Trust Services Criteria and designed for broader distribution to customers, prospects, and other stakeholders.

02 SOC 1 Examinations

SOC 1 Type 1 and Type 2 examinations of service organization controls relevant to user entities’ internal control over financial reporting.

05 SOC 2+ Examinations

SOC 2+ examinations incorporating additional industry, regulatory, or security frameworks to address specific customer, contractual, and compliance requirements.

03 SOC 2 Examinations

SOC 2 Type 1 and Type 2 examinations addressing controls relevant to security, availability, processing integrity, confidentiality, and privacy.

06 Specialized SOC Reporting

SOC for Cybersecurity and SOC for Supply Chain examinations addressing cybersecurity risk management and controls across production, manufacturing, and distribution systems.

Discuss Your SOC Reporting Needs

Type 1 or Type 2: Which SOC Report Do You Need?

Both SOC 1 and SOC 2 examinations may result in either a Type 1 or Type 2 report. The appropriate option depends on your customer requirements, control readiness, available evidence, and reporting timeline.

Comparison

Type 1

Type 2

Reporting Period

As of a specified date

Over a specified period

Control Design

Evaluated

Operating Effectiveness

Not evaluated

Evaluated throughout the period

Common Use

Initial SOC examination or point-in-time assurance

Ongoing assurance regarding control operation

Some organizations begin with a Type 1 examination and later proceed to Type 2, while others may be prepared to begin directly with Type 2.

Not sure which SOC service you need?

Schedule a consultation

A Clear Path to Your SOC Report

From initial scoping through report issuance, we provide an organized process with clear expectations at each stage.

01 — Define the Report and Scope

We learn about your services, systems, customers, contractual requirements, subservice organizations, reporting objectives, and desired timeline.

02 — Evaluate Readiness

When readiness support is needed, we assess control design, documentation, system-description readiness, and available evidence to identify gaps before the examination begins.

03 — Prepare for the Examination

Management addresses identified gaps, assigns control responsibilities, finalizes documentation, and establishes processes for retaining evidence of control performance.

04 — Complete the Examination

We perform the applicable examination procedures. For a Type 2 engagement, this includes testing whether controls operated effectively throughout the specified examination period.

05 — Issue the SOC Report

After completing the examination and addressing outstanding matters, we issue the applicable independent service auditor’s report and discuss considerations for the next reporting cycle.

SOC Reporting Resources

Explore practical articles and guides to help service organizations navigate SOC reporting, prepare for examinations, strengthen relevant controls, and respond to customer and stakeholder assurance requirements.

View All SOC Reporting Resources

01

Define the Report and Scope

02

Evaluate Readiness

03

This is a title. Click here to edit and add your own text.

04

This is an extra long title. Click here to edit and add your own text. It's easy.

Leadership team evaluating a SOC 2 provider’s independence, qualifications and evidence process.

SOC 2 Auditor Independence: What AICPA Scrutiny Means for Tool-Provider Relationships in 2026

AICPA’s 2026 ethics guidance and public notice put new attention on relationships among SOC 2 auditors, compliance platforms and service organizations. Here is what buyers should verify.

Infographic about vendor risk management with a laptop, checklist icons, office desk, and steps to identify, assess, monitor, and review.

Why Vendor Risk Management Fails: The Gap Between Collecting SOC Reports and Reviewing Them

Many organizations believe they have a vendor risk management process because they collect SOC reports, insurance certificates, security questionnaires, or compliance documents from their vendors. But collecting documents is not the same as reviewing risk.

Supply Chain Risk and SOC Reporting

Optimizing risk by leveraging SOC reports.

Organizations We Serve

Software and cloud-service providers responding to enterprise security reviews, customer contracts, and vendor-management requirements

SaaS and Cloud Platforms

payment-payroll-financial-processors (1).png

Service providers whose activities or controls may affect customer financial reporting or transaction processing.

Payment, Payroll, and Financial Processors

Organizations that host, manage, process, transmit, secure, or support customer systems and information.

Managed IT and Data Providers

Organizations supporting healthcare, administrative, data-management, claims, billing, or other outsourced operational functions.

Healthcare Technology and Business Process Providers

Service Organizations FAQs

Get SOC Reporting Updates & Resources

Subscribe to receive practical SOC reporting updates, readiness guidance, control-documentation tips, and new resources from JConner.