SOC 2 Type 2 Report: What It Is, What's Inside, How to Read

In Q3 2026, audit firms quoted companies with up to 50 employees a median $9,000 for a SOC 2 Type 2 audit, in ballpark quotes through SOC2Auditors.org before scoping.

Fees by company size are in the SOC 2 audit cost guide.

What is inside a SOC 2 Type 2 report?

A Type 2 report has four parts and an optional fifth: the service auditor’s report (the opinion), management’s assertion, the system description, and the controls with their tests and results. The optional fifth part, other information, is unaudited. The table shows who wrote each part and what to check first.

Order varies by report, so use the contents page instead of assuming a section number. Sprinto, a compliance vendor, reported that of eight company reports it reviewed in September 2026, five opened with the auditor’s report and three with management’s assertion. It also reported that those eight reports and the AICPA’s illustrative one ran 31 to 84 pages, with a median of 52.

New to SOC 2? Start with What is SOC 2 compliance? or our SOC 2 compliance guide, which follows an audit from scope to report.

What does each part of a Type 2 report tell you?

Read the opinion and the period first, then the system boundary, then the test results. Only the auditor’s report is the CPA firm speaking for itself. Management writes the assertion and the system description, and the auditor tests the controls that description lists.

The auditor’s report and the four opinions

An unmodified (also called unqualified or clean) opinion means the system was described fairly and the controls were suitably designed and operated throughout the period. It can still sit beside exceptions in the test results. A qualified opinion means the auditor found a material but not pervasive problem with specific controls, or could not test some of them. The basis paragraph says which. An adverse opinion means the controls as tested did not do what the description says they do. A disclaimer of opinion means the auditor could not gather enough evidence to form one.

The report also states when the period starts and ends, and the opinion speaks only to that period. A report that closed months ago says nothing about the months since, which is the gap a bridge letter is meant to cover (see the validity question below). Our guide to SOC 2 exceptions and qualified opinions explains how auditors reach each opinion and how to weigh it.

Management’s assertion and the system description

Management’s assertion is a short, signed statement from the company’s leadership. It is the company’s claim, and the auditor’s report is the independent opinion on that claim.

The system description sets the boundary of everything else. If your team depends on a vendor’s mobile app but the audit covers only their web platform, the report says nothing about the app. The description also names the subservice organizations the company relies on, such as a cloud host or data center. When the report carves one out, the auditor did not test that provider’s controls, and the report should list the complementary subservice organization controls (CSOCs) the company expects the provider to run. Complementary user entity controls (CUECs) point the same idea at you: they are the controls the company expects its customers to operate. See carve-out versus inclusive method and complementary user entity controls for how to review each.

Controls, tests, and results

The bulk of the report is a table with a row for every control the auditor tested. Each row gives the control, the test the auditor ran (typically inquiry, observation, inspection, or reperformance), and the result. A failed test is an exception, documented in the same row. A few isolated exceptions with specific management responses read differently from a pattern of failures in access control or change management. Management’s responses often sit in the optional other-information part, which the auditor did not examine.

What does an actual Type 2 report look like?

The five excerpts below come from a SOC 2 Type 2 report that a SaaS company posts publicly. It covers the Security category only and a period of a few months. Dates appear as [period start] and [period end], the company’s own wording is paraphrased, and the quoted sentences are standard report language found in many SOC 2 reports.

1. The opinion (auditor’s report).

In our opinion, in all material respects […] The controls stated in the description operated effectively throughout the period [period start] to [period end] […] if complementary subservice organization controls and complementary user entity controls assumed in the design of [the company]‘s controls operated effectively throughout that period.

The opinion carries no qualification, so it is unmodified. It is also conditional: it holds only if the carved-out providers and the company’s customers ran their own controls. That “if” is why the subservice and user-entity lists below are worth reading.

2. Management’s assertion.

We confirm, to the best of our knowledge and belief, that […] The controls stated in the description operated effectively throughout the period [period start] to [period end]

This is the company’s claim. The check is whether it matches the auditor’s report: both should name the same system and the same period. A mismatch in system or dates is worth a question.

3. The period and scope. The cover states the period, and the report adds that no Trust Services Category other than Security is in scope.

A period of a few months with Security alone is a permitted scope, since the AICPA sets no fixed minimum period and lets the company choose its categories. Whether it answers your questions is your call. The signing date also matters: the opinion is dated some months after the period closed, so a buyer reading it much later would ask for the current report.

4. A test row with exceptions (controls, tests, and results). The control says all full-time employees complete security training when they join and every year. In our paraphrase, the auditor’s sample showed missed onboarding training deadlines and some employees who had not completed training in the past year.

The report maps this control to criterion CC1.4, “The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives” (AICPA Trust Services Criteria). The opinion above stays unmodified even though the report lists exceptions on other controls too. Management’s responses sit in the other-information part, and the auditor says of them “we express no opinion on it.” Read the counts, not just the word “exception”: a miss on every sampled new hire, for example, is a different finding from one miss among a dozen employees.

5. The CUEC list (system description). The report lists several responsibilities for the company’s customers. Two of them, paraphrased: customers decide which of their own staff can access the product, and customers review the company’s change notices and judge how each change affects their own controls.

The report says the list “does not purport to be, and is not, a complete listing.” These are your tasks, and the opinion in call-out 1 depends on them. The same section names two hosting providers as subservice organizations and says the examination did not cover their controls.

For a checklist of what to do with a report once you have it, see how to review a SOC 2 audit report.

Does the testing look tailored, and who signed it?

The AICPA’s Peer Review Board has named a specific quality risk in SOC 2 work: engagements that are not designed around the service organization’s own risks, which produce identical reports, risk assessments, sample sizes, and testing procedures. Its May 2026 reviewer alert, covered in the Journal of Accountancy, tells peer reviewers to look at how a firm uses third-party SOC platforms, whether engagement timelines are reasonable, and whether engagements are tailored to each client.

That guidance tells peer reviewers where to look. It does not make any individual report defective, and a reader cannot apply it to one report in isolation. Two practical checks follow. If you hold two reports from the same firm, control descriptions, test procedures, and sample sizes that look identical across companies with different systems may be worth a question to the vendor or the auditor. You can also look up the signer: the AICPA Peer Review Public File lists a firm’s most recent accepted review. Our guide to AICPA peer review and SOC 2 auditor quality explains how to read it, and the SOC 2 auditor directory shows each listed firm’s peer-review result where one is on record.

What does a Type 2 report prove, and what does it not?

A Type 2 report shows that an independent CPA firm tested a company’s controls over a period and gave an opinion, which is stronger evidence than a policy document or a questionnaire answer. It covers only the system, criteria, and period stated in the report, so a clean opinion does not mean the company is secure everywhere.

A Type 1 report covers control design at one date. A Type 2 adds testing of whether the controls operated across a period, which is why buyers ask for it. The comparison, including fees and when to choose each, is in our SOC 2 Type 1 vs Type 2 guide.

Is SOC 2 Type 2 a certification?

No. SOC 2 Type 2 is an attestation report: a CPA firm examines the controls and issues an opinion, and the AICPA does not certify anyone. People say “SOC 2 Type 2 certification” loosely, but the deliverable is a report. An ISO 27001 certificate is a short document confirming a passing audit, while a Type 2 report contains the opinion, the system description, and the results for every control tested, so you hand over the full report, usually under NDA. See why SOC 2 is an attestation, not a certification and SOC 2 vs ISO 27001.

How long is a SOC 2 Type 2 report good for?

A SOC 2 report has no expiry date. Many buyers treat it as current for about 12 months after the end of its period, then ask for the next one. Schellman calls 12 months the general rule of thumb and says each customer decides.

That leaves a gap when a prospect asks in March for a report whose period ended the previous December. A bridge letter (also called a gap letter) covers it: a short, management-signed statement that no significant control changes occurred since the period closed. Bridge letters are not audited, so buyers treat them as a stopgap, not a substitute for a fresh report. See our SOC 2 bridge letter guide for a template and how long buyers accept one.

Who can issue a SOC 2 Type 2 report?

Only a licensed CPA firm (or a non-US equivalent) can issue a SOC 2 report. The firm has to follow the AICPA’s attestation standards (AT-C 105 and AT-C 205) when planning and performing the engagement. Consultants, readiness firms, and compliance automation vendors can help you prepare, but they cannot sign the report.

Can a company fail a SOC 2 Type 2 audit?

There is no pass or fail score. The auditor issues one of the four opinions above, and an unmodified opinion is the outcome to aim for. A readiness assessment finds problems before the auditor does. For what each outcome does to deals and the way back, see what happens if you fail a SOC 2 audit.

Where to go from here

If you were sent a report, the SOC 2 audit report guide covers reviewing it, and SOC 2 report red flags covers what lowers a reviewer’s trust. If you need your own, the SOC 2 audit timeline covers the process, the observation period guide covers choosing the window, the readiness assessment finds control gaps first, and SOC 2 audit cost has current ranges. To compare firms by peer-review result, timeline, and price, use the SOC 2 auditor directory.