SOC 2 Audit Report: Sections, Opinions and How to Read One

A SOC 2 audit report (also called a SOC 2 report) is a written report from a licensed CPA firm on a service organization’s controls, measured against the AICPA’s Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. It holds the auditor’s opinion, management’s assertion, a description of the system, and the controls in scope. A Type 2 report also tests whether those controls operated effectively over a stated period and lists the results. A Type 1 covers the design of controls on a single date and has no operating-effectiveness testing.

The auditor is independent of the company, so the report is third-party evidence rather than the vendor’s own claim. It is one of the AICPA’s SOC reports: a SOC 1 report covers controls relevant to a customer’s financial reporting, and SOC 3 is a short public summary. SOC 1 vs SOC 2 explains which one a customer is asking for. Our guide to SOC service providers explains who does the work.

How to Read a SOC 2 Report: Three Questions in Order

Read a SOC 2 report in this order: the opinion and report period, the system description (does it cover the service you are buying?), the exceptions in the control tests, then what the report leaves to you: customer-side controls, carved-out subservice providers, and any gap since the period ended. An unmodified opinion (also called unqualified or clean) is the auditor’s conclusion on the audited system. It does not tell you the report covers your use, or that every control passed.

These steps answer three questions: can I rely on this report, does it cover what I am buying, and what does it leave to me. The review matrix below turns each into a check and a request to send the vendor.

SOC 2 Type 1 vs Type 2 Reports

A Type 1 report gives an opinion on the design of controls as of one date. A Type 2 report gives an opinion on design and on operating effectiveness across a review period. That changes what is in the document, and so what a reviewer can rely on:

Which to commission is a separate decision: see SOC 2 Type 1 vs Type 2. For what a Type 2 contains, see what a SOC 2 Type 2 report is; for the review period, the observation-period guide.

Sections of a SOC 2 Report

Many SOC 2 reports use a five-part layout like this one. Numbering and order vary by firm, and the AICPA does not prescribe the format of the system description, so treat it as a map, not a standard. Our annotated Type 2 report excerpts show each part in the language of a published report.

1. Section I, auditor’s report. The CPA firm’s opinion that the controls are suitably designed (Type 1) or suitably designed and operating effectively over the period (Type 2). It names the signing firm.
2. Section II, management’s assertion. The company’s signed statement that its system description is fair and its controls met the chosen criteria. This is what the auditor opines on.
3. Section III, system description. The services, infrastructure, software, people, data, and processes in scope, the criteria selected, and usually the customer-side controls and subservice organizations. It sets the boundary of the audit.
4. Section IV, criteria, controls, tests, and results. Each control mapped to the criteria it supports. A Type 2 adds the auditor’s test procedures, results, and any exceptions here. A Type 1 lists the controls but has no test steps or results.
5. Section V, other information (optional). Unaudited content the company chooses to include, such as management’s response to exceptions. The auditor does not opine on it, so read it as the company’s statement.

What the AICPA Standards Require in Each Section

The AICPA does not fix a layout, but it does set what the auditor’s report and the system description must contain, and gives guidance on the rest. AT-C section 205 sets the requirements for the auditor’s report. The SOC 2 Guide is the AICPA’s guidance on applying them to SOC 2, and DC section 200 sets the criteria the system description is measured against. Citations are to the 2023 edition of AT-C sections 100 to 300, the SOC 2 Guide as of 15 October 2022 and DC section 200 (2018 criteria, 2022 implementation guidance), checked on 21 October 2026. The last column is our reading advice, not an AICPA requirement.

How to Review a Vendor’s SOC 2 Report

Each row below is one check under the three questions above (can I rely on it, does it cover what I am buying, what does it leave to me), with what a good result looks like, what to ask the vendor when it is not, and where to read more. The “good” column is our editorial judgment, not an AICPA requirement, and buyers set their own requirements for report type and age.

Nearly every SOC 2 report includes Security, so ask about one that does not. Availability, processing integrity, confidentiality, and privacy are optional, so check which the vendor chose. A report can also be scoped to one product line or environment, so compare the named service with the one you will use. A vendor on a public cloud may rely on the provider’s own report for the infrastructure layer; our guides to AWS SOC 2 compliance and GCP SOC 2 compliance show how auditors treat those inherited controls.

These are evidence-quality checks, not a decision about whether the vendor fits your requirements. The SOC 2 Quality Guild’s reliability rubric draws the same line, covering how much weight to give a report as evidence rather than whether a vendor is right for a particular buyer.

Acceptance is a judgment call. If the first four rows hold and the follow-ups are answered, accept the report and record who owns each CUEC. If the answers are partial, such as a gap since the period ended or an unclear scope, accept with conditions and put a date on each follow-up. If the opinion is modified, the scope leaves out the service you buy, or exceptions repeat in access, change management, or incident response, escalate to whoever owns the vendor risk. Read the opinion, period, and scope for every vendor. Read the controls and exceptions for vendors that hold your sensitive data. Anything missing is a question to send back to the vendor, not a reason to abandon the review.

Customer-Side Controls (CUECs)

Complementary user entity controls are the controls the vendor assumes you run for the system to meet its commitments, such as removing leavers’ access or enforcing single sign-on on your own tenant. They usually sit in the system description (Section III). Read each one, give it a named owner at your company, and confirm it is in place, because the auditor tested the vendor’s controls and not yours. A report with no CUECs for a service you configure heavily is worth a second look. The CUEC guide walks through acting on the list.

Subservice Providers: Carve-Out or Inclusive

A subservice organization is a provider whose controls the vendor depends on, such as a cloud host. Under the carve-out method, the report names the provider and the controls assumed of it, but the auditor does not test them, so you obtain the provider’s own SOC report for that assurance. Under the inclusive method, the provider’s controls are described and tested in the vendor’s report. Check which method the report uses, and request the providers’ reports when it carves them out. The carve-out vs inclusive guide explains how to tell the two apart.

Who Signed It

The opinion letter names the CPA firm that signed the report. Two checks sit outside the report. First, confirm the firm and the signing CPA are licensed: our CPA licensing guide covers the state-board and CPAverify lookups. Second, look the firm up in the AICPA Peer Review public file and read the result and its date; our peer review guide explains each outcome. A firm that does not appear in the public file is a question for the vendor, not a finding on its own. The report authenticity checks cover the rest, and the SOC 2 auditor directory lets you compare firms.

Auditor Opinions and Red Flags

The auditor’s opinion in Section I is the CPA firm’s formal conclusion. AT-C section 205, the AICPA’s standard for examination engagements, defines the possible opinions, and each turns on what the auditor concluded about the evidence. The table of section requirements gives the paragraph behind each. For the wider set of signals reviewers check, see SOC 2 report red flags.

The Four Types of Auditor Opinions

In order from clean to most severe:

1. Unmodified (unqualified) opinion, also called a clean report. The auditor obtained sufficient appropriate evidence and concluded that the subject matter agrees with the criteria in all material respects and that management’s assertion is fairly stated.
2. Qualified opinion. The auditor concluded that misstatements are material but not pervasive, or could not obtain sufficient evidence and judged the possible effects material but not pervasive. It reads as “fairly stated, except for” a named matter. Read the basis for the qualification to see which controls or criteria it affects.
3. Adverse opinion. The auditor concluded that misstatements are both material and pervasive. Escalate before relying on the report.
4. Disclaimer of opinion. The auditor could not obtain sufficient appropriate evidence and judged the possible effects both material and pervasive. The auditor expresses no opinion. It reflects a scope limitation.

Any opinion other than unmodified should prompt a direct conversation with the vendor about what the auditor found and what has been fixed. Our exceptions and qualified opinions guide covers how to weigh each.

Look Past the Opinion to the Exceptions

A clean opinion does not end the review. An exception is a documented instance where a control failed during testing. For example, an auditor might sample 25 employee terminations and find one where access was not revoked within the required window. That is logged as an exception, and the opinion can still be unmodified if the failure is not material. Linford & Company, a CPA firm, calls an unqualified opinion alongside exceptions “quite common”. How an auditor decides when exceptions are material and pervasive enough to modify the opinion is in how auditors judge exceptions.

Isolated exceptions are normal in a long Type 2. Patterns are the concern: several exceptions in access controls, change management, or incident response can point to a weakness the high-level opinion does not surface.

Read Management’s Response to Exceptions

When exceptions appear, the report usually includes a management response, often in Section V. A strong response names the root cause and the corrective action with a date. A vague or defensive one is a signal about how the company treats control failures. Because this section is unaudited, treat its commitments as claims, not verified facts.

How Long a SOC 2 Report Is Valid (and Bridge Letters)

A SOC 2 report has no expiry date set by the AICPA. Schellman describes 12 months as the general rule of thumb and says it is entirely up to the customer what they will accept. In practice, a report whose period ended more than a year ago usually prompts a request for a current one.

A Type 2 report also covers a period that ended in the past. If the period ended on December 31 and you are reviewing it in May, the report says nothing about the months since. Vendors cover that gap with a bridge letter (also called a gap letter), a statement from the vendor’s management on whether material changes to controls have occurred since the report’s end date. Management signs it, not the auditor, so it carries less weight than the report, and Linford notes bridge letters typically cover no more than three months. Our bridge letter guide covers what one should include.

Most vendors renew annually, because customers expect a recent report, so a run of consecutive Type 2 reports with no gaps between periods tells you more than a single one. Our SOC 2 audit renewal playbook covers how vendors keep that coverage unbroken.

If You Are the Vendor: What a Buyer’s Reviewer Will Ask

A buyer’s reviewer will run the matrix above against your report, so expect five questions. Our guide to SOC 2 report red flags covers what else lowers a reviewer’s trust: how you describe the report, the pattern of your report periods, and signs of a thin audit.

1. Does the system description name the product and environments the buyer will use? A report scoped to one product line or environment does not cover a service outside it.
2. When did the period end, and what covers the gap since? Keep a bridge letter ready and know the dates of your next period.
3. What were the exceptions, and what did you do about them? Have the root cause, the fix, and the date for each. Section V is unaudited, so a reviewer reads your response as a claim.
4. Can a customer perform your CUECs? Write them as actions a customer can complete and evidence. See the CUEC guide.
5. Which providers are carved out, and where are their reports? Name each subservice organization and the method used. See the carve-out vs inclusive guide.

Customers and prospects can see your SOC 2 report, but not publicly. Its restricted-use paragraph limits the report to your company, your customers, and prospective customers who understand the system, so vendors share the full report under an NDA. A public trust center page can show the report type, the audit period, the CPA firm, the criteria in scope, and your subprocessors, while the full report, with its system description, test results, and any bridge letter, goes out on request. Trust center software compares the tools that run that request and NDA flow.

You get a SOC 2 report by engaging a licensed CPA firm to examine your controls; a vendor cannot issue its own. How long a Type 2 takes depends mainly on the observation period you choose, plus the readiness work before it and the reporting after. For the work itself, see SOC 2 audit cost, how long a SOC 2 audit takes, and how to choose a SOC 2 auditor.

Frequently Asked Questions About SOC 2 Reports

Is a SOC 2 Report a Certification?

No. People say “SOC 2 certified,” but SOC 2 produces an attestation report, not a certificate. An independent CPA firm examines the controls and states a formal opinion on whether the system description is fair and the controls are suitably designed and, for a Type 2, operating effectively. It does not issue a pass/fail credential. For the longer answer, see Why is SOC 2 an attestation, not a certification?

How Often Do You Need a SOC 2 Report?

Buyers set their own requirements, and 12 months from the end of the review period is the common rule of thumb. Vendors that run the audit annually usually hold a current report, but consecutive periods do not have to meet; a bridge letter can cover a short gap between one report’s end date and the next.

What Is the Difference Between SOC 2 and SOC 3?

Both cover the same Trust Services Criteria, but they serve different audiences. A SOC 2 report is the detailed, restricted document, shared under NDA, containing the system description, controls, and the auditor’s tests. A SOC 3 report is a short public summary with the auditor’s opinion but none of the sensitive control detail, so it can be posted on a website. For a full breakdown, see SOC 2 vs SOC 3 report differences.

What If My Report Has Inaccuracies?

You review a draft before the report is issued. Read the system description and control list closely. If a process is misstated or the wrong tool is named, flag it with your auditor before issuance. An accurate report avoids back-and-forth during later vendor reviews.

---

To compare SOC 2 audit firms by pricing, timeline, and industry fit, start with the SOC 2 auditor directory.