How to Read a SOC 2 Report: A Section-by-Section Guide

To read a SOC 2 report, start with the auditor's opinion, then check the report type and audit period, then the scope of the system described, and only then the control tests and exceptions. The whole document can run 50 to 100 pages. A focused review usually comes down to five questions: who audited, what was covered, when, what failed, and what you must do on your side.

This guide walks through each section in the order a security reviewer works, with what to look for and what should make you ask the vendor follow-up questions. It is written for managing partners, IT directors and business leaders who receive a vendor's report and have to decide whether to rely on it.

TL;DR

• Read the auditor's opinion first. An unqualified opinion is the clean result; qualified, adverse or disclaimer opinions need a direct conversation with the vendor.
• Confirm the report type (Type 1 or Type 2), the audit period, and that the system in scope is the one you actually use.
• Go to the exceptions in the controls section and judge them by what failed, how often, and what management did about it.
• Find the complementary user entity controls (CUECs). They are tasks the report assumes you perform.
• Use a bridge letter only to cover the gap since the report period ended, never as a replacement for the report.

Table of Contents

• What a SOC 2 report is and who writes it
• Step 1: Check the report type and audit period
• Step 2: Understand the five sections
• Step 3: Read the auditor's opinion
• Step 4: Confirm the scope in the system description
• Step 5: Read the controls, tests and exceptions
• What a SOC 2 bridge letter does and does not tell you
• A practical review workflow
• Reading SOC 2 reports at a law firm or energy company
• Get help reviewing vendor reports
• FAQ
• Sources

What a SOC 2 report is and who writes it

A SOC 2 report is an attestation issued by an independent CPA firm. It evaluates a service provider's controls against the AICPA's Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Only a CPA firm licensed by a state board of accountancy and following the SSAE 18 attestation standard can issue one.

The AICPA's SOC 2 Guide, updated as of October 15, 2022, covers the 2017 Trust Services Criteria with revised points of focus and the 2018 description criteria, and is the reference auditors work from.

Two points shape how you read it. The report describes the vendor's controls, not yours. And it is a point-in-time or period-based opinion, so its value depends on how current and how relevant it is to your use of the service. If you want the wider background first, our SOC 2 explainer for business leaders covers the framework itself.

Step 1: Check the report type and audit period

Before reading any narrative, find two facts on the cover or in the auditor's opinion.

Type 1 or Type 2. A Type 1 report says controls were suitably designed as of a single date. A Type 2 report adds testing: it says controls operated effectively over a stated period. For vendor reliance, Type 2 gives you much more, because it shows controls working over time rather than on paper on one day. Our guide on when Type 1 works and when Type 2 is needed explains the trade-off from the vendor's side.

The audit period. A Type 2 period is commonly 12 months, though there is no required minimum length. Ask three questions:

1. When did the period end? A report whose period ended many months ago says little about today.
2. Is the period long enough to be meaningful? A three-month first-year window is legitimate but gives less evidence than a full year.
3. Are there gaps between consecutive reports? Back-to-back periods with no break show continuous coverage.

Many buyers set an internal rule for how recent a report must be. Write yours down and apply it to every vendor in the same way.

Step 2: Understand the five sections

Most reports follow the same pattern: four sections and an optional fifth. The order varies by firm, so check the headings rather than relying on position. SANS describes the typical layout as the auditor's report, management's assertion, the system description, the criteria and controls with tests, and other information from management.

Step 3: Read the auditor's opinion

The opinion is the most important paragraph in the report. It comes in four forms, as explained by a CPA firm's guide to SOC reports:

• Unqualified: the tested controls were designed and operating as described. This is the result most vendors present.
• Qualified: a material issue exists, but it is not pervasive.
• Adverse: the issues are material and pervasive, such that the vendor could not meet all or most of its service commitments and system requirements.
• Disclaimer: the auditor did not have enough information to form an opinion.

Also read the opinion for the names of the criteria in scope. A report that covers security alone is a different assurance from one covering security, availability and confidentiality. If you send client files to the vendor, confidentiality matters. If you depend on uptime, availability matters.

Check who issued the report

SOC 2 audits have no pre-issuance quality review independent of the issuing firm. HITRUST's assurance paper advises that a recipient planning to rely heavily on a report should consider the firm's qualifications, experience, licensure, peer review status and quality record. A short check of the firm's licensure and peer review status takes minutes and belongs in your file.

Step 4: Confirm the scope in the system description

Scope is where reports most often disappoint. A clean opinion on a narrow system tells you nothing about the parts that fall outside it. The system description covers the services provided, the principal service commitments and system requirements, system components, system incidents, control activities, CUECs, subservice organizations, criteria not applicable to the system, and, for Type 2 reports, significant changes during the period.

Work through this checklist:

• Product match. Does the described system include the product, modules and environments you use? Some vendors scope only one product line.
• Infrastructure. Which cloud or hosting provider supports the system, and which data centers are in scope?
• Excluded criteria. If a criterion is marked not applicable, is the reason credible for the service you buy?
• Incidents. Does the description disclose incidents during the period, and how were they handled?
• Changes. Were there major system changes, such as a migration or acquisition, midway through the period?

If the scope falls short of how you use the service, you have two options: ask the vendor for additional assurance, or compensate with your own controls and contract terms. Our vendor security due diligence guide shows how to document that decision.

Subservice organizations: carve-out or inclusive

Most vendors rely on others, such as a cloud host. The report treats them in one of two ways. Under the carve-out method, the description names the subservice organization and its services but excludes its control objectives and controls from the auditor's procedures. Under the inclusive method, those controls and the auditor's procedures at the subservice organization are part of the report.

Carve-out is the common choice, which means you should look for the list of complementary subservice organization controls (CSOCs) and ask whether the vendor reviews its own providers' SOC reports.

Complementary user entity controls (CUECs)

CUECs are controls that management assumed customers would run, and that are necessary, together with the vendor's controls, to achieve the service commitments. Typical examples include removing departed employees' access, managing your own user permissions and reviewing activity logs.

This is the section that turns a vendor's report into your to-do list. For each CUEC, record who on your team owns it and whether it is actually performed. A vendor's clean report does not protect you if your side of the shared responsibility is unmanaged.

Step 5: Read the controls, tests and exceptions

Section four is the longest. For each control you will see the vendor's control description, the auditor's test and the result. Most rows read "no exceptions noted". The rows that do not are the ones worth your time.

An exception is a deviation from the expected result when testing one or more control activities. Three basic types exist: misstatements in the system description, design deficiencies and operating effectiveness deficiencies.

An exception does not automatically change the opinion. A Type 2 report lists every deviation found, and if other controls still met the objective, the auditor can issue an unmodified opinion. So judge each exception on its own:

A few exceptions in a large report are normal and can indicate the auditor tested thoroughly. A pattern of repeated failures in the same area, or in the controls tied to your data, is the signal to escalate.

Two cautions about comparing vendors. SOC 2 has no standard numeric score, and reports vary in their controls, testing and results, so comparison is a manual process requiring considerable judgment. Build a consistent review template so every vendor is judged on the same questions.

What a SOC 2 bridge letter does and does not tell you

A Type 2 report covers a period that has already ended, so by the time you read it a gap has usually opened between the period end and today. A bridge letter, also called a gap letter, is a short statement from the vendor's management, typically one or two pages on company letterhead, saying whether anything significant has changed in its systems or controls since the period ended.

How to use one well:

• It covers a short window. Bridge letters are normally used for the few months between the end of the audit period and the date of your review. If the gap is longer, ask when the next report is due.
• It is management's statement, not the auditor's. The CPA firm has not tested the gap period, so it provides less assurance than the report itself.
• It should be specific. Look for the report period it refers to, a statement on changes to controls, systems and personnel, and any known incidents, signed by a named officer.
• It never replaces a report. A vendor with no current report and only a letter has not shown you controls operating.

File the letter next to the report and set a reminder to request the next report when the new period closes.

A practical review workflow

A repeatable process saves time across dozens of vendors:

1. Log the vendor, report type, period, issuing firm and criteria covered.
2. Read the opinion and note any modification.
3. Verify scope against the services and data you actually use.
4. List subservice organizations and the method used.
5. Extract every exception and the management response.
6. List the CUECs and assign an owner for each.
7. Request a bridge letter if the period ended outside your recency rule.
8. Record the decision: accept, accept with conditions, or escalate.

For a broader view of where the report fits among your other checks, see our guides on SaaS vendor security assessment and vendor cybersecurity assessment. If you are choosing between report families, SOC 1 and SOC 2 differ in what they examine: financial reporting controls versus security and related criteria.

Reading SOC 2 reports at a law firm or energy company

If you handle client confidences or operational data, the criteria that matter most are usually security and confidentiality. Law firms should map the vendor's scope to where privileged documents live, and our SOC 2 guide for law firms shows what clients increasingly expect. For oil and gas and energy operators, availability and the vendor's incident history deserve extra weight, since downtime has operational consequences.

Our perspective

We read SOC 2 reports for a living, and the same pattern repeats: leaders read the opinion, see a clean result and stop. The real exposure is usually in the scope and in the CUECs. A report can be accurate and still cover a system you do not use, or assume controls your team never implemented.

Our approach is to treat each report as an input to a risk decision, not a pass/fail certificate. A vCISO gives a managing partner or IT director a consistent method: confirm the period, test the scope against your data flows, weigh the exceptions, assign owners to the CUECs, and document the outcome so you can show clients and auditors your diligence.

Our platform supports this work by organizing assessment intake and reporting across 50+ frameworks, so vendor reviews stay consistent as your vendor list grows. Fractional leadership costs less than a full-time CISO, and it brings the judgment that a checklist alone cannot.

vCISO

Get help reviewing vendor reports

If your team lacks the time or the security background to review each report, we can do it with you. CISOSafe is a Houston-based virtual CISO firm that supports law firms, energy companies and other regulated organizations with security risk assessments, compliance program management, policy development and audit readiness. We can set up a review method, handle the reports that matter most and brief leadership in plain language.

See our vCISO and compliance services or start at cisosafe.com to talk with us about your vendor risk program. If you are preparing your own report, the SOC 2 readiness control matrix is a good starting point.

FAQ

What should I look at first in a SOC 2 report?

Start with the auditor's opinion, the report type and the audit period. These three facts tell you whether the report is clean, whether it tested controls over time and whether it is recent enough to rely on. Then move on to scope and exceptions.

Is a SOC 2 report with exceptions a bad report?

Not necessarily. An exception is a deviation found during testing, and the opinion can stay unmodified if other controls still met the objective. Judge each one by which control failed, how often, and how management responded. Repeated failures in controls that protect your data deserve a direct conversation with the vendor.

What is the difference between a qualified and an adverse opinion?

A qualified opinion means there is a material issue that is not pervasive. An adverse opinion means the issues are material and pervasive. In both cases, ask the vendor what happened and what has been fixed before you rely on the report.

Do I need a bridge letter?

Ask for one when the report period ended a while ago and you are relying on the report today. It is management's statement about changes since the period ended and is not tested by the auditor. It supports a recent report and never replaces a missing one.

What are CUECs and why do they matter?

Complementary user entity controls are controls the vendor assumes you operate, such as managing your own user access. If you do not perform them, the vendor's controls may not deliver the protection the report describes. Assign an owner to each one.

Sources

• What is SOC 2?
• AICPA SOC 2 Guide
• An Expert's Guide to Reviewing SOC 2 Reports, SANS
• Understanding the Key Elements of Your SOC Report, UHY
• CSOCs and CUECs in a SOC Report
• User entity and subservice disclosures
• Testing and Audit Exceptions in SOC Reports, Linford
• The Assurance Gap, HITRUST

Recommended

• SOC 2 Readiness: Control Matrix Fields Mapped to AICPA for U.S. Teams
• SOC 2 Compliance Explained for Business Leaders
• SOC 1 and SOC 2: Which Report Does Your Organization Need?
• SOC 2 Compliance for Law Firms: 2026 Guide