# Fastpath Completes SOC 1 Type 2 Examination - URL: https://dynamicaccounting.net/fastpath-completes-soc-1-type-2-examination/ - Date: 2018-11-29 - Topics: Fraud, Audit & Controls, Microsoft & the GP Ecosystem - Type: original article [Fastpath has completed their SOC 1 Type 2 examination.](https://www.gofastpath.com/blog/fastpath-completes-soc-1-type-2-examination) Let’s talk about SOC’s and why they matter. Not socks, though they keep you warm. Not SOX in white or red, though they can be fun to watch, but SOCs. A SOC (service organization control) is an attestation standard, a form of an audit. It means that if you use cloud services, your auditors may rely on the cloud provider’s SOC to reduce their work. It also means that a cloud provider has been deliberate about their controls and those controls have been audited to ensure appropriate operation. Like you, Fastpath has 2 SOCs cleverly known as a SOC 1 and a SOC 2. They break down like this: - SOC 1: Internal Controls over Financial Reporting (ICFR). - SOC 2: Controls at a service organization that are relevant to security, availability, processing integrity confidentiality, or privacy. [] If your cloud provider doesn’t have at least a SOC 2, you’ve got problems. A SOC 2 is tied to control over the provider’s data. Without that, you have to wonder about what kind of protection is in place. A SOC 2 is relevant for any cloud provider. A SOC 1 is appropriate if that cloud provider is also tied to Financial Reporting. But there is also more than one type of each SOC. A type 1 indicates that the company has set up controls and the design of the controls have been reviewed. A type 2 indicates that the controls have been in place for a period of time and then been audited. You can’t get a type 2 overnight. Fastpath has BOTH a SOC 1 Type 2 and a SOC 2 Type 2. These reports aren’t always publicized, so if you’re unsure, ask your cloud providers. If you get dumb looks and blank stares, be very nervous.