When a vendor sends an audit or attestation report, read five things before you rely on it: scope, period or date, exceptions, the auditor's name and standard, and the controls left to you. The logo on the front page tells you little. These five tell you whether the report covers the service you buy.
Why reading matters
Reports such as BSI C5 examinations and AICPA SOC reports are written by auditors the provider chooses. BSI states it does not select auditors or check C5 reports, and puts the job of analysing the report on the customer. That is true for most scheme reports. The report is evidence. You still decide.
The five reads
- Scope. Which service, product, locations and systems? A vendor may have several services and only one is covered.
- Date or period. Some engagements check at a point in time. Others also look at whether controls were met over a past period. BSI notes this distinction for C5. A newer date is better, and a gap between period end and today deserves a question.
- Exceptions. Look for noted deviations or qualified opinions. One exception can matter more than ten pages of clean text.
- Standard and auditor. Which version of the criteria? Who signed it? A report against an older version is not wrong, but ask about the plan to update.
- Customer duties. Reports often list controls you must operate yourself. Copy them into your own register.
What the system description tells you
The system description in a report sets out the provider's procedures, processes and measures. Read it for the boundary: what is inside, what is a subservice provider, where data lives. It often answers questions your questionnaire did not.
Ask the follow up
Short questions that work:
- Does the scope include the production environment my data will sit in?
- Were there exceptions, and what was done about them?
- Which of the listed customer controls apply to us?
- When is the next report expected?
Keep a record
Log the vendor, report type, scope, period, exceptions and next review date. Our checklist for reading a C5 report shows the same approach for one scheme.
Safeguard's compliance and evidence automation can hold vendor documents and review dates in one place, which makes yearly repeat reads easier.
Quick check
Is an attestation report the same as a certificate?
No. It is an auditor's report. Read its scope, period and exceptions.
How often should I re-read a vendor report?
BSI advises customers to repeat the C5 review yearly. A similar yearly habit suits other reports.
Sources
Last reviewed: 19 October 2026.
