SOC 2 vs SOX: which one your company needs first
Start with your legal position, not with the audit report. SOX Section 404 is the issuer's own assessment of internal control over financial reporting (ICFR), and it applies only to public companies. SOC 2 is a CPA attestation on a service organization's security controls under the AICPA's Trust Services Criteria, and it is requested by customers rather than imposed by statute. If you are a public company, Section 404(a) management assessment is mandatory, and whether the external auditor's attestation under 404(b) applies depends on your filer status and emerging growth company status. If you are a private SaaS company answering security questionnaires, SOC 2 is the likely first step, and SOX does not apply to you at all.
The overlap is the vendor case. If your platform processes transactions, billing, payroll or ledger data that feeds a customer's financial statements, your customer's auditors will need evidence about your controls. The PCAOB's AS 2201 treats services that are part of the company's information system as part of its ICFR, so the customer's auditor may ask for a SOC 1 (an ICFR-focused report) rather than a SOC 2. Confirm with your customers' finance and audit teams which report they accept before you choose. A SOC 2 security report does not replace a SOC 1 for that purpose.
Do both when you are a public company that also sells a platform whose controls its customers rely on, or when a customer's ICFR evidence needs a service auditor's report that a SOC 2 does not provide. Management can rely on a Type 2 service auditor's report for its own 404 work, but not if its own audit firm prepared that report, so plan the engagement and independence structure before you start. Ask the auditor which report, Type 1 or Type 2, and which period each customer needs, and write those requirements into the statement of work so one examination can serve both purposes where the scope allows.
How SOC 2 and SOX 404 differ on scope, obligation and output
This table compares who must comply, what each examination covers, who may rely on the output and what proof results. Read it as two different questions: SOX 404 asks whether a public company's financial reporting controls work, while SOC 2 asks whether a service organization's security controls are described and tested for customers.
| Dimension | SOC 2 | SOX Section 404 |
|---|---|---|
| Who is obligated | No law requires it. A service organization engages a CPA firm because customers or partners ask for it | Public issuers. Management must assess ICFR each year (404(a)), and accelerated and large accelerated filers that are not emerging growth companies also need an auditor attestation (404(b)) |
| Question it answers | Are the security controls described accurately, suitably designed (Type 1) and operating effectively over a period (Type 2), against the trust services criteria in scope? | Does management's own ICFR evaluation, against a recognized framework, support reliable financial reporting as of fiscal year end? |
| What the work covers | Systems and controls chosen for the report, anchored on the common criteria and any added categories (availability, processing integrity, confidentiality, privacy) | Controls over financial reporting, including IT general controls that the company's facts show are needed for other controls to work consistently |
| Who may rely on the output | Use of a SOC 2 report is generally restricted. A SOC 3 report is a general use document that can be freely distributed | Investors and the public, through the annual filing. Management's assessment and any auditor attestation are published by the issuer |
| Who pays the auditor | The service organization pays its CPA firm under the engagement | The issuer pays its registered public accounting firm for the 404(b) attestation where it applies. Confirm the fee structure with your auditor |
| Emerging growth company treatment | Not applicable. Emerging growth status does not change SOC 2 scope | Exempt from the 404(b) auditor attestation, though management's 404(a) assessment still applies |
| Where SOC 1 fits | Not the SOC 1 route. SOC 1 covers controls relevant to customers' internal control over financial reporting, which is the vendor case when your system feeds a customer's financial statements | Vendor systems that are part of the issuer's information system are treated as part of its ICFR, so the issuer tests them as its own controls |
| Confirm with counsel or auditor | Whether your customers require SOC 1 or SOC 2, and which criteria belong in scope | Your filer status, whether 404(b) applies in a given year, and which IT general controls the evaluation must cover |
Who must meet SOX 404 and who needs a SOC 2
A public issuer that is an accelerated or large accelerated filer, and not an emerging growth company, carries the full Section 404 load. Management must assess internal control over financial reporting (ICFR) every fiscal year under Section 404(a), and the issuer's registered public accounting firm must attest to and report on that assessment under Section 404(b). The auditor's attestation is the public-facing proof, and it covers the company's own controls, including IT general controls that support financial reporting. A SOC 2 is not a substitute for any part of this.
- Management assessment: The CEO and CFO certify the company's controls and the annual ICFR evaluation under Section 404(a) and Rule 13a-15(c).
- Auditor attestation: The registered public accounting firm attests to management's assessment under Section 404(b) and reports on it.
- Vendor services in scope: Where a service organization's services are part of the company's information system, PCAOB AS 2201 treats them as part of ICFR, so the auditor needs evidence about them.
- Vendor evidence: Management may rely on a service auditor's SOC 1 or Type 2 report, but not where the registrant's own audit firm prepared it.
- Buyer requests: Investors and auditors look to the SOX evidence, and the company usually requests a SOC 1 from critical vendors rather than a SOC 2.
Confirm your filer status with securities counsel and your auditor each year, because status changes can switch the 404(b) requirement on or off.",
A public issuer that is an emerging growth company, or that is neither an accelerated nor a large accelerated filer, still owes management's assessment under Section 404(a), but the auditor attestation under Section 404(b) does not apply. The 404(b) exemption comes from the JOBS Act of 2012 for emerging growth companies, and from the statute's own filer conditions for other issuers. Management must still document controls, evaluate them against a recognized framework, and be ready to explain them to its auditor for the financial statement audit.
- Management assessment remains: Section 404(a) and Rule 13a-15(c) still require an annual evaluation of ICFR as of fiscal year end.
- No auditor attestation: The registered public accounting firm does not attest under Section 404(b) for these issuers.
- Cost difference: The SEC estimated in 2020 that a newly exempt issuer would save about $210,000 per year on average, roughly $110,000 in audit fees and $100,000 in other costs (Release 34-88365).
- Vendor reports: Buyers and auditors may still ask for a SOC 1 covering vendor controls that feed financial reporting.
- Status changes: An issuer that loses an exemption can become subject to 404(b) later, so plan the controls evidence as if the attestation may arrive.
Confirm whether your company qualifies for an exemption and for how long with counsel and your audit firm before you set your audit budget.
A private vendor is not subject to SOX 404 itself, but its system can be part of a customer's ICFR when it processes or records financial data that the customer relies on. In that case the customer's management and auditor test the vendor's controls as part of the customer's own evaluation. The vendor's obligation is contractual and practical: it has to give the customer evidence that its controls operate. The report most often requested for this purpose is a SOC 1, which is intended for user entities and their auditors.
- Likely request: A SOC 1 Type 2 report, because it addresses controls relevant to customers' internal control over financial reporting.
- Security assurance: A SOC 2 may also be requested to cover security, availability or confidentiality, but it does not replace a SOC 1 for financial reporting reliance.
- Shared evidence: Ask whether the customer's auditor will accept your report and what period it must cover.
- Scope agreements: Define which systems, interfaces and data feeds are in scope before the audit begins.
- Gaps: Identify controls that the customer's auditors will test, such as change management and access to financial data.
Confirm with each customer whether it needs a SOC 1, a SOC 2, or both, and which period and control objectives its auditor expects.
A private SaaS company with no link to a customer's financial reporting has no SOX 404 obligation and no ICFR role. Its assurance need comes from security questionnaires, procurement reviews and contract clauses, which usually point to a SOC 2 report. The SOC 2 examines security controls under the AICPA's Trust Services Criteria, and its use is generally restricted to the company's customers and prospects under agreement. Because SOX does not reach this company, the scope and criteria are chosen by the company and its buyers.
- No SOX duty: Section 404 applies to issuers, so a private SaaS company is not subject to it.
- Likely request: A SOC 2 Type 2 report over security, with other categories added only if they are in scope.
- Report type: A Type 1 covers the system description and control design at a date, while a Type 2 adds operating effectiveness over a period.
- Public version: A SOC 3 report can be shared broadly if the company wants a public assurance document.
- Customer expectations: Buyers may still ask about financial controls that touch their data, which is a question for contracts rather than SOX.
Confirm with your customers which criteria and report period they require before you choose the examination scope.
Where SOC 1 fits when a vendor's system feeds customers' financial reporting
If your system produces or processes data that a customer records in its general ledger, the report that matters is often a SOC 1, not a SOC 2. SOC 1 is an examination of controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting. It is intended for those user entities and for the CPAs who audit their financial statements. A SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality or privacy, so it does not answer a financial reporting question on its own, even when the same controls appear in both examinations.
The reason this matters is PCAOB AS 2201 paragraph B18. It says that when a service organization's services are part of the company's information system, they are part of the company's ICFR, and the auditor includes them in deciding what evidence is needed. A public company that outsources payroll, billing, or transaction processing therefore has to assess those services inside its own Section 404 work. The SEC staff FAQ adds that management may rely on a Type 2 service auditor's report even when the same firm audits both companies, but not when the registrant's own audit firm was engaged to prepare that report. Ask your customer's auditor which report they will accept, whether a SOC 1 Type 2 with the complementary user entity controls they expect the customer to run, or a SOC 2 they have agreed to read for specific criteria. Confirm this in writing before you scope the audit.
Who assesses each framework, what is issued and how often
This table compares who performs each assessment, which standards govern the work, what document comes out and how often it recurs. Read it to see that SOX 404 judges a public company's own financial reporting controls, while SOC 2 reports on a service organization's controls for customers. Neither produces a certificate.
| Dimension | SOX Section 404 (issuer) | SOC 2 (service organization) |
|---|---|---|
| Who performs the assessment | Management assesses its own internal control over financial reporting. For accelerated and large accelerated filers that are not emerging growth companies, the registered public accounting firm attests to that assessment. | A licensed CPA firm acting as service auditor examines the service organization's controls. The service organization writes the system description and provides written representations. |
| Standards the work follows | Management applies a recognized framework under Rule 13a-15(c), such as COSO 2013. External auditors test under PCAOB AS 2201 and assess IT risk under AS 2110. | The examination runs under AT-C section 205 of the AICPA attestation standards. Controls are judged against the 2017 Trust Services Criteria, and the system description follows the 2018 description criteria (DC 200). |
| Primary output | Management's annual ICFR assessment, plus an auditor attestation report where Section 404(b) applies. The auditor's report sits in the issuer's annual filing. | A SOC 2 Type 1 report (design as of a date) or Type 2 report (design and operating effectiveness over a period). Use is generally restricted to existing customers and prospects who sign appropriate terms. |
| General use output | No general use equivalent. Investors receive the issuer's filed disclosures. | A SOC 3 report covers the same categories in less detail and can be freely distributed, which suits public marketing material. |
| Cycle | Annual, evaluated as of each fiscal year end. Management's assessment applies to every issuer in scope, including emerging growth companies. | Type 1 is a point-in-time review. Type 2 covers an observation period that the service auditor and management agree, and reports are typically refreshed on a recurring cycle set by customer demand. |
| Certificate issued | None. The output is an assessment and an attestation, not a certification. | None. A SOC 2 is an attestation report, not a certificate, and it does not declare the organization compliant. |
| Who can use the output | Management, the board, auditors, investors and regulators through the public filing. | Customers and prospects who need assurance about outsourced controls. Each user reads the report against its own risk assessment. |
| What DeployOpen provides | Preparation of IT general control documentation, testing evidence and readiness support for management's assessment. DeployOpen does not issue audit reports or attestations. | Preparation of controls, evidence and readiness for a SOC 2 examination. DeployOpen does not issue SOC 2 reports, which are issued by an independent CPA firm. |
Where the SOX and SOC 2 work overlaps, and where it does not
A SOC 2 report and a Section 404 assessment can draw on the same access, change and operations evidence, but they answer different questions with different scope rules. The cards below show where the two sets of work meet, where the SOX scope is narrower, and where SOC 2 asks for more.
Shared access and change evidence
Auditors of a SOC 2 Type 2 and the external auditor testing ICFR often sample the same artifacts: user access reviews, joiner and leaver approvals, privileged access logs and change tickets with testing and approval evidence. Where one population serves both reports, the company can design the control once and tag it to both sets of criteria. Confirm that both audit teams agree on the population and sample period before fieldwork starts.
COSO Principle 11 link
COSO's 2013 Internal Control, Integrated Framework includes Principle 11, which calls for general control activities over technology that support the organization's objectives. The SOC 2 common criteria CC1 to CC5 restate COSO's 17 principles, so the same control environment and governance evidence can answer both reports. Map your control matrix to the COSO principles first, then to the criteria, so the SOX team and the SOC 2 examiner work from one set of controls.
SOX ITGC areas from 33-8810
SEC Release 33-8810 names program development, program changes, computer operations and access to programs and data as areas management might consider when evaluating IT general controls. The release presents these as examples, because the relevant areas vary with each company's facts and circumstances. Use these four areas as a starting inventory for SOX scope, then confirm with the external auditor which systems feed material financial reporting.
Security criteria beyond financial reporting
SOC 2 common criteria CC6 to CC9 cover logical and physical access, system operations, change management and risk mitigation, and they apply to every SOC 2 engagement regardless of ledger impact. Availability, confidentiality, processing integrity and privacy criteria join the scope only when the company selects them. A vendor may pass a SOX review of a payroll system yet still owe evidence of intrusion monitoring or incident response that a customer's SOC 2 reviewer requests.
Narrower SOX scope for efficiency
Management needs to evaluate only the IT general controls necessary for the proper and consistent operation of other controls that address financial reporting risks. Controls that affect only operational efficiency fall outside that evaluation under Release 33-8810. A SOC 2 examiner may still test the same system's controls for security reasons, so read the SOX scope memo and the SOC 2 system description side by side to find the gap before either audit begins.
No published ITGC catalog
No SEC rule or PCAOB standard publishes a catalog of IT general controls, and the aspects relevant to an ICFR evaluation vary by company. The overlap between SOX and SOC 2 therefore has to be mapped by the company's own external auditor. Ask that auditor to confirm in writing which systems, controls and samples count for Section 404, and bring the SOC 2 control matrix to that discussion before scoping either engagement.
Sequencing SOX and SOC 2 work when a company needs both
The sequence keeps one set of controls and evidence serving both the SOX 404 assessment of internal control over financial reporting and the SOC 2 report customers request, so the company does not run two unrelated control programs. The order below is typical, but the auditor's view on scope and sequencing governs.
Confirm filer status and scope with counsel and auditors
Management, securities counsel and the external auditor confirm which SOX obligations apply, including whether the company is an accelerated or large accelerated filer, whether it is an emerging growth company, and therefore whether Section 404(b) auditor attestation applies in addition to management's Section 404(a) assessment. Ask the auditor to confirm in writing which entity and period the 404 work covers. The step is done when the filer category and 404 scope are recorded in a memo the auditor has reviewed.
Map systems that feed financial reporting
Finance and IT list every application, data flow and third-party service that initiates, processes, stores or reports transactions that affect the financial statements. Hosted services that feed the general ledger are part of the company's information system for ICFR purposes, so vendors whose systems are in this map need to be identified early. The step closes with a signed system inventory that finance and the auditor both accept as the population for testing.
Define the ITGC scope management can evaluate
Using SEC Release 33-8810, management determines which IT general controls are necessary for the proper and consistent operation of controls that address financial reporting risks. The guidance names program development, program changes, computer operations and access to programs and data as areas to consider, but it does not apply to every company and does not require controls that only affect operational efficiency. The output is a documented ITGC scope with a rationale for each area included or excluded.
Decide the SOC 2 scope and categories
Leadership decides which systems the SOC 2 covers and which trust services categories apply. Security is always in scope through the common criteria, while availability, processing integrity, confidentiality and privacy are added only when the company wants them reported. Customers' questionnaires and contracts usually drive this choice, and the system description must match the systems mapped in the previous step. The step is complete when a written scope statement names the systems, categories and period the report will cover.
Build one control inventory with shared evidence
Build a single control matrix in which each control records its owner, frequency, the financial reporting risk it addresses, the SOC 2 criteria it supports and the evidence it produces. Where a control serves both SOX and SOC 2, such as access reviews or change approvals, the company keeps one control with one evidence trail rather than two copies. Where the two frameworks need different precision, the matrix shows the gap so it is not hidden. The step closes when the auditor and the SOC 2 examiner each confirm the parts of the matrix they will rely on.
Run a Type 1 or readiness review before the Type 2 period
Before the first Type 2 observation period starts, a readiness review or Type 1 examination checks that the control design and system description are suitable as of a date. Gaps found here can be fixed before a period of operating effectiveness begins, which is the period the Type 2 opinion covers. DeployOpen can prepare the control documentation and evidence for this review, but the examination and any opinion are issued by an independent CPA. The step is done when remediation items are logged and owners have accepted them.
Test controls and keep the evidence trail current
Control owners perform and document the recurring controls throughout the SOC 2 observation period, and the SOX testing team samples the same controls for the 404 assessment. Evidence is captured once, with dates and reviewer sign-off, so both examiners can rely on it. Exceptions found by either team are shared with the other so the root cause and remediation are recorded once. The step is complete when the evidence set is complete for both examinations and exceptions have documented remediation.
Align the reporting calendar and deliver both outputs
Finance, IT and the auditors agree on one calendar that sets the year-end assessment date for management's ICFR evaluation, the SOC 2 period end and the dates the report and bridge letters are needed by customers. Management's annual ICFR evaluation is tied to each fiscal year end under Rule 13a-15(c). The step closes when both the SOX assessment and the SOC 2 report are issued, and the company can show which controls and evidence each one relied on.
What drives the cost of SOX 404 and SOC 2 work
The cost of SOX 404 work is spread across parties who are paid for different things, so the first step is separating them. Management carries the ICFR assessment itself: time spent scoping controls, documenting processes, testing controls and concluding on effectiveness each fiscal year. Where Section 404(b) applies, the issuer's registered public accounting firm is paid to attest to that assessment. The SOC 2 side works differently. A CPA service auditor is paid to examine your controls against the trust services criteria, and your own team carries the internal effort of collecting evidence, maintaining the system description and answering auditor requests. Remediation of control gaps is a cost for both, and it is usually the least predictable line. Some costs are one-time and some recur. Setup costs include the first scoping, control design, tooling, system description work and any remediation needed before the first examination. Recurring costs come from the annual cycle: the yearly assessment or examination period, evidence collection, access reviews and change records, and the fees for each new audit. A SOC 2 Type 2 examination covers an operating period, so evidence must be collected continuously rather than assembled in the weeks before fieldwork. Ask every bidder which costs are fixed for the first cycle and which change when scope, system count or period length changes. The SEC's 2020 estimate in Release 34-88365 put the average saving for an issuer newly exempt from the 404(b) auditor attestation at about $210,000 per year, roughly $110,000 in audit fees and $100,000 in other costs. That figure is an average across affected issuers, not a quote for your company, and it covers only the attestation savings. It does not measure management's own 404(a) assessment time, the cost of internal control remediation, or the cost of a SOC 2 report. DeployOpen does not publish prices. Quotes follow a written scope, and most engagements are fixed-scope. Before requesting one, confirm in writing: which systems and financial reporting processes are in scope, whether 404(b) applies or the company is exempt, which trust services categories and period length are needed, how evidence collection and remediation are priced, and which deliverables and retained evidence the quote includes. Ask each party to name who performs the work and who signs the report.
Questions buyers ask before choosing SOC 2, SOX 404 or both
Does a private SaaS company have to comply with SOX 404?
No, not unless it is an issuer. SOX Section 404 obligations fall on the issuer, meaning a company that files reports with the SEC. A private SaaS company that sells to public companies is not directly subject to 404(a) or 404(b), but its public customers may ask for evidence about controls that feed their financial reporting. Those customers decide what they need, so confirm with your auditor whether your company has any SEC filing obligation at all. Ask your auditor to confirm your issuer status in writing before you scope any SOX work.
Does a SOC 2 report satisfy SOX 404?
No. A SOC 2 is a CPA attestation on a service organization's security and other trust services criteria, while SOX 404 requires management of an issuer to assess its own internal control over financial reporting. A SOC 2 can be one input a public customer's management uses when it evaluates controls at a vendor, and the SEC staff FAQ says management may rely on a Type 2 service auditor's report in some cases. Reliance is the customer's decision and depends on the report's scope, so ask your customer's auditor what they will accept.
Does a vendor need a SOC 1 or a SOC 2?
It depends on what your system does for the customer. A SOC 1 examines controls at a service organization that are likely to be relevant to user entities' internal control over financial reporting, and it is intended for the customer's financial statement auditors. A SOC 2 covers security, availability, processing integrity, confidentiality or privacy under the trust services criteria, and its use is generally restricted. If your platform processes transactions or records that flow into a customer's financial statements, ask that customer's auditor whether they need a SOC 1. If customers ask about security practices, a SOC 2 is usually the request.
How long does a SOC 2 or SOX 404 assessment take, and what drives the timeline?
Timelines depend on scope, the observation period and how ready your controls are, and no supplied figure gives a standard duration, so ask your auditor and any implementation partner for a timeline in writing. A SOC 2 Type 1 covers the design of controls as of one date, while a Type 2 covers operating effectiveness over a period, so a Type 2 needs time to collect evidence across that window. A SOX 404 assessment depends on the issuer's fiscal year end and its ICFR scope. The main drivers are the number of trust services categories in scope, the number of systems in scope, how much evidence exists already, and whether the auditor needs to be engaged early.
What does the work need from internal staff?
The work needs named control owners who can explain and evidence their controls, and it usually needs finance, IT and engineering to share the system description. For a SOC 2, management prepares the description of the system against the AICPA's 2018 description criteria and provides written representations, so leadership must review and sign those statements. For SOX 404, management owns the ICFR assessment and must evaluate IT general controls relevant to financial reporting risks. Ask your auditor which systems, reports and evidence owners they will test, and budget internal time against that list.
Can our team run a SOC 2 or SOX 404 assessment without a consultant?
Some teams can prepare internally, but the attestation itself must come from an independent CPA firm, so the question is who prepares the evidence and who tests it. Internal teams can often map controls, collect evidence and draft the system description, provided they have someone who understands the trust services criteria or COSO's 2013 framework and the SEC's ICFR guidance. A consultant may be useful for gap analysis, control design and evidence automation. Confirm with your auditor which parts of the preparation you may do yourself, since the auditor's independence rules limit what the same firm can prepare.
What does a fixed-scope engagement with DeployOpen cover?
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications, so the CPA firm still performs the SOC 2 or SOX attestation. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ask for the written scope to list the systems, control areas, evidence types and handover items, and confirm with your auditor that the evidence format meets their testing needs.
How DeployOpen prepares SOC 2 and SOX-ready evidence
DeployOpen helps teams with self-hosted open-source platforms in their own infrastructure build the control evidence an auditor will ask for. We scope the systems that feed financial reporting and customer security reviews, then document, test and hand over the evidence in a form your auditors can review.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope names which systems, access paths and IT general control areas are in or out, and who owns each.
- We confirm with your auditor whether the work targets a SOC 2 examination, SOX Section 404 evidence, or both.
How we build
- We configure and harden self-hosted platforms in your cloud accounts, data centers or air-gapped networks.
- We build access, change and operations controls with recorded owners, approvals and review cadence.
- We run security testing against the in-scope systems and log remediation against each finding.
How we hand over
- We deliver control descriptions, procedures and evidence collection instructions mapped to the agreed scope.
- Handover includes the test results, remediation records and open items your auditor will need to review.
- We document what was prepared, but independent auditors and certification bodies issue any report or opinion.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
- Retainers can keep evidence current between SOC 2 examination periods or annual Section 404 assessments.
- Ask for a written quote tied to your scope, and confirm evidence formats with your auditor before work begins.
Sources and further reading
- 15 U.S.C. 7262, Management assessment of internal controls (SOX Section 404 as amended), GovInfo ↗
- Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting, Release 33-8810 (June 2007), SEC ↗
- AICPA SOC 1: SOC for Service Organizations, ICFR ↗
- AICPA SOC 2: SOC for Service Organizations, Trust Services Criteria ↗
- Management's Report on ICFR and Certification of Disclosure in Exchange Act Periodic Reports, Frequently Asked Questions, SEC staff ↗
- Journal of Accountancy (AICPA): Explaining the 3 faces of SOC (2016) ↗
