How to Read a
SOC 2 Report

The report opens with the auditor’s letter — a few pages that carry all of the assurance. It states the scope (the system, the period, the applicable trust services criteria), each party’s responsibilities (management prepared the description and assertion; the auditor examined them), the inherent limitations of any system of controls, and — the part to read twice — the opinion paragraph. Opinions come in four forms: unmodified (clean), qualified (fair except for specific described matters), adverse (the description is not fairly presented or controls broadly failed), and a disclaimer (the auditor could not obtain enough evidence to opine). We unpack what triggers each in SOC 2 opinions and exceptions. This is the first thing experienced reviewers read: three minutes here tells you whether the remaining hundred pages deserve two hours or ten.

A SOC 2 is an assertion-based examination: the auditor does not examine the system in the abstract, it examines management’s written claims about the system. Section 2 is that claim — management asserts the description is fairly presented and that controls were suitably designed (and, for Type 2, operated effectively over the period) to meet the applicable criteria. It reads like boilerplate, and mostly is — but it puts management’s name, not just the auditor’s, behind the report. Quick check: the system name, period, and categories in the assertion should match the opinion and the description exactly. Mismatches are drafting errors at best.

The longest prose section, prepared by management under the AICPA Description Criteria (DC section 200 — specific to SOC 2; SOC 1’s description requirements live in AT-C 320 instead). A conforming description covers the services provided; the principal service commitments and system requirements — what the organization promises customers and what the system must do to deliver it; the system’s components across five dimensions (infrastructure, software, people, procedures, and data); relevant incidents; which trust services categories are in scope; complementary user entity controls (CUECs) — the controls the report assumes you operate; subservice organizations and whether they are treated under the carve-out or inclusive method; and, in Type 2 reports, significant changes to the system during the period. Read it for the boundary above all else: a vendor may operate ten products, and the description may cover one. If the product, environment, or entity you buy from sits outside the described system, the opinion — however clean — does not cover your risk.

The heart of the report and usually more than half its page count: a matrix pairing each applicable criterion with the organization’s controls, the auditor’s tests, and the results. Controls are evaluated against the Trust Services Criteria (the 2017 criteria, points of focus revised in 2022), organized into five categories: Security — mandatory in every SOC 2, expressed as the common criteria CC1–CC9 and aligned to the 17 COSO internal-control principles — plus optional Availability, Processing Integrity, Confidentiality, and Privacy. In a Type 2, each row shows the test procedures (inquiry, observation, inspection of evidence, reperformance) and a result: “no exceptions noted,” or a description of the exception found. A Type 1’s Section 4 describes control design only — no tests of operating effectiveness, no results. Exceptions are not automatic failures: read each one against the opinion (did it drive a qualification?) and against management’s response.

Some reports end with an unaudited appendix: most commonly management’s responses to the exceptions in Section 4, remediation status, and planned system or control changes. The auditor performs no procedures on this section, and it sits outside the opinion. It is still worth reading — a thoughtful, specific exception response says a lot about a control environment — but weigh it as management’s unaudited words, nothing more.