How to Read a SOC 1 Report: A 20-Minute Review Method for User Entities

Your payroll provider, loan servicer, or BPO just sent over a 90-page PDF, and someone — your auditor, your risk team, a customer — expects you to have "reviewed the SOC 1." Most reviews stop at confirming the report exists. That misses the point: a SOC 1 is not a certificate, it is an auditor's opinion plus evidence — and the parts that affect you are usually buried in the middle. Here is the 20-minute method we use.

Know the four sections

Nearly every SOC 1 report follows the same skeleton. Section 1 is the service auditor's report — the CPA's opinion letter. Section 2 is management's assertion, required by AT-C section 320. Section 3 is management's description of the system — services, procedures, control objectives, and the controls themselves. Section 4 contains the auditor's tests of controls and results (Type 2 only) — the largest and most informative section. Some reports add a Section 5 for "other information" from management, which the auditor has not examined; treat it as marketing.

Check 1 — The opinion (2 minutes)

Open Section 1 and find the opinion paragraph. You want "fairly presented / suitably designed / operated effectively" — an unqualified opinion. A qualified opinion names specific objectives that failed; an adverse opinion or a disclaimer is a red flag that warrants escalation, not filing. Confirm the report is the right type while you're here: a Type 1 covers design at a point in time only — if you or your auditors need reliance over a period, only a Type 2 does the job.

Check 2 — The period vs your fiscal year (2 minutes)

A Type 2 covers a stated window — say October 1 to September 30. If your fiscal year ends December 31, the last quarter is uncovered. That gap is normal; the fix is a bridge letter from the vendor's management stating whether controls materially changed in the interim. If the gap exceeds a quarter, or the vendor can't produce a bridge letter promptly, note it as a finding in your vendor review.

Check 3 — Exceptions in Section 4 (5 minutes)

Skim the test-results column for the word "exception." An exception is not automatically a crisis — auditors note deviations even when the objective was still met overall. Read each one for three things: what failed, how often (1 of 25 samples is different from 12 of 25), and whether management's response addresses the cause. Exceptions clustered in access control or change management deserve the most attention, because they undermine every other control tested. If the opinion stayed unqualified despite exceptions, the auditor judged them immaterial — but your materiality may differ from theirs.

Check 4 — Your CUECs (5 minutes, the one everyone skips)

Section 3 lists complementary user entity controls (CUECs) — the controls the report assumes you operate: approving payroll input before submission, deactivating leavers promptly, reviewing output reports. The auditor's opinion is explicitly conditional on these. Map every CUEC to a named control and owner on your side; if you can't, the report's assurance doesn't fully apply to you — and your own auditors may ask to see exactly this mapping. This is the single highest-value 5 minutes in the whole review.

Check 5 — Subservice organizations (3 minutes)

Still in Section 3, find the subservice organizations — the vendor's own vendors, usually carved out (cloud hosting is the classic case). Under the carve-out method their controls were not tested in this report; instead the description lists the complementary subservice organization controls (CSOCs) relied on. For each carved-out provider that matters to your risk, confirm the vendor monitors it — and for critical ones, ask for that provider's own SOC report.

Wrap-up: the three follow-ups worth sending (3 minutes)

First, a bridge letter if the period doesn't reach your year-end. Second, management's remediation status for any exceptions that touched access, change management, or reconciliations. Third, the next report's timing, so the gap never exceeds a quarter. File the report with your CUEC mapping attached — that combination, not the PDF alone, is what "we reviewed the SOC 1" should mean. If you'd like the checks in printable form, download the free SOC 1 checklist; and if you're the service organization on the other side of this review, our team has supported 100+ SOC 1 engagements — we can help you produce a report that survives it.