How to read a SOC 2 report: start with the auditor’s opinion, then check the period and scope, the criteria included, the subservice organizations, the complementary user entity controls (CUECs) and the exceptions in the test results. Most reports run to dozens of pages, but about ten checks tell you whether you can rely on it.
What sections does a SOC 2 report contain?
A SOC 2 report is typically organized in five parts: the independent service auditor’s report, management’s assertion, the description of the system, the criteria with tests of controls and results, and optional other information. Names and order can vary slightly between firms.
| Section | What to look for |
|---|---|
| Independent service auditor’s report | Opinion type, period, criteria, subservice organizations |
| Management’s assertion | Management’s statement that the description is fair and controls meet the criteria |
| Description of the system | Services, infrastructure, software, people, data and boundaries of scope |
| Criteria, controls, tests and results | Each control, how it was tested and any exceptions (Type II) |
| Other information (optional) | Management responses, additional detail, not covered by the opinion |
For the background on report types and criteria, see our SOC 2 audit guide.
Which 10 checks should you run on a SOC 2 report?
Run these ten checks in order. Each takes minutes and together they catch most of the problems that make a report less useful than it looks.
Ten-point SOC 2 review
- Opinion type: unmodified, qualified, adverse or disclaimer. Read any qualification in full.
- Report type: Type I (design at a date) or Type II (operation over a period).
- Period or date: how recent is it, and is there a gap to today that needs a bridge letter?
- Service scope: do the described systems and locations include the service you actually use?
- Criteria included: Security is always present; are Availability, Confidentiality, Processing Integrity or Privacy covered if you need them?
- Subservice organizations: which vendors are carved out, and did the vendor review their reports?
- Complementary user entity controls (CUECs): which controls must your own team operate?
- Exceptions: which controls, how many, how severe and recurring?
- Management responses: did the vendor explain and remediate the exceptions?
- Auditor: is it a recognized licensed CPA firm, and does the opinion read as a standard SOC 2 report?
What is the opinion and why read it first?
The opinion is the CPA firm’s conclusion on whether the system description is fair, the controls are suitably designed and, in a Type II report, operated effectively. It tells you what weight the rest of the report deserves.
An unmodified opinion means no material problems were found. A qualified opinion means material issues in a specific area, and an adverse opinion means material and pervasive problems. Our guide to SOC 2 exceptions and qualified opinions explains each type.
What are subservice organizations and CUECs?
Subservice organizations are vendors the service provider relies on, such as a cloud host, and CUECs are controls the provider assumes you run on your side. Both show where responsibility sits.
- Carve-out method: the subservice organization’s controls are excluded from testing, and the report refers to its own SOC report.
- Inclusive method: its relevant controls are described and tested as part of the report.
- CUECs: for example, promptly revoking access for your own departed employees or configuring application permissions correctly.
Under SSAE 18, which the AICPA issued in 2016, management must monitor the controls of subservice organizations that are part of its control environment, and the AICPA’s criteria define what the report evaluates. If you do not run your CUECs, an objective may not be met even though the vendor’s controls work. See our SSAE 18 guide for how carve-out, inclusive and CUECs are defined.
How do you judge exceptions?
Judge exceptions by what they affected, how widespread they were and whether the vendor fixed them. A single minor lapse in a low-risk control is different from repeated failures in access or change management.
- Which control: access, change and incident controls matter more for most buyers.
- How many: compare deviations to the number of samples tested.
- Recurrence: compare with the vendor’s prior report if you have it.
- Response: look for root cause and remediation, not just acknowledgment.
What should vendors check before sharing their report?
Vendors should read their own report the way a buyer will. Confirm the scope describes the product customers use, the period is current, and any exceptions have a clear management response.
If your report is stale, a bridge letter signed by management can cover the gap between the end of the audit period and today. The SOC 2 roadmap explains renewal timing, and a SOC 3 report offers a public summary that does not require an NDA.
Next Assurance scopes your report so it covers the services buyers actually review. See our SOC 2 audit service.
Frequently asked questions about reading a SOC 2 report
What should I look at first in a SOC 2 report?
Start with the independent service auditor’s report to see the opinion type, the report period or date, and the criteria covered. An unmodified opinion is the goal. Then confirm the described system and locations match the service you buy, because a report only covers the scope it names, whatever the vendor’s marketing says.
What are CUECs in a SOC 2 report?
Complementary user entity controls are controls the service organization assumes its customers will implement for the stated criteria to be met, such as promptly deactivating former employees’ accounts. If you do not operate them, the objective may not be met even though the vendor’s own controls run properly, so every customer should read them.
What does a carve-out mean in a SOC 2 report?
The carve-out method means a subservice organization, such as a cloud provider, is excluded from the testing and the report refers to its own SOC report instead. It also lists the controls expected of that provider. To rely on the whole chain, review the subservice organization’s report too, or ask the vendor how they did.
How recent should a SOC 2 report be?
Buyers commonly treat a report as current for about 12 months from the end of the audit period. A SOC 2 report does not technically expire, because the AICPA’s standards set no validity period. If the period ended long ago, ask for a management-signed bridge letter covering the gap, and a timeline for the next audit.
Is a SOC 2 with exceptions a red flag?
Not automatically. Exceptions are deviations noted while testing, and a report can contain some and still have an unmodified opinion. Weigh which control was affected, how many samples failed, whether the issue recurred and what the vendor did about it. A thoughtful management response matters as much as the exception itself.
Can I get a vendor’s SOC 2 report without an NDA?
Usually not. A SOC 2 report is restricted-use and is normally shared under NDA with customers and prospects. Vendors often publish a SOC 3 report, which is designed for general use, as a public trust signal. For due diligence you will still typically need the full SOC 2.
Sources
Facts checked against primary sources on October 7, 2026. Report section names can vary between audit firms.
- AICPA & CIMA – System and Organization Controls: SOC Suite of Services: the AICPA’s overview of SOC 1, SOC 2 and SOC 3 reports.
- AICPA & CIMA – Statement on Standards for Attestation Engagements No. 18: the attestation standard that governs how CPA firms perform SOC examinations.
- Keiter CPA – Types of Audit Opinions in SOC 2 Reports (May 26, 2020): unmodified, qualified, adverse and disclaimer opinions.
- AICPA & CIMA – 2017 Trust Services Criteria (With Revised Points of Focus – 2022): the criteria a SOC 2 examination evaluates.
