Definition

Type I report

A Type I report gives an auditor's opinion on whether a service organization's controls are suitably designed at a single point in time. It answers one question: on this date, were the right controls in place and built to meet the objectives or criteria? Because it skips operating-effectiveness testing over a period, a Type I moves faster and often serves as a first milestone for a company new to SOC reporting. Customers still tend to want a Type II eventually, since design alone does not prove the controls actually ran day after day.