Read a SOC 2 report in this order: the type and period, the auditor's opinion, the system description and scope, the list of exceptions, subservice organizations, and the complementary user entity controls. Those six parts tell you whether the report covers your use and what you must still do yourself.
Know what you are holding
SOC 2 reports are issued by licensed CPA firms, and they report on controls at a service organization. The AICPA describes SOC offerings as assurance reports that help users assess risks of outsourcing services. A SOC 2 report covers criteria such as security, availability, processing integrity, confidentiality or privacy, depending on what the vendor chose.
A SOC 2 report is an attestation by an independent auditor. It is not a certification, and you should not call it one in your vendor file.
Step 1: Type and period
Type 1 describes whether controls were suitably designed at a single date. Type 2 also tests whether they operated over a period, often six to twelve months. For a vendor that holds sensitive data, Type 2 is the stronger evidence. Check that the period ended recently. A report that ended eighteen months ago leaves a gap.
Step 2: The opinion
Look for the auditor's opinion. An unqualified opinion means the auditor found the description fair and the controls effective for the period. A qualified opinion means there was a significant problem. Read the reason.
Step 3: Scope and system description
Which products, locations and infrastructure are in scope? Which criteria were included? If you use a feature or region that is outside the description, the report does not speak to it. This is the most common gap.
Step 4: Exceptions
The testing section lists exceptions: controls that did not work as described in some samples. A few exceptions are normal. Read the management response. Ask: was it fixed, and is it relevant to my data? Exceptions in access removal or change management deserve a follow-up.
Step 5: Subservice organizations
Vendors rely on hosting and other providers. The report says whether those providers are carved out, meaning their controls are not tested in this report, or included. If carved out, you may need to look at the provider's own report too.
Step 6: Complementary user entity controls
These are controls the vendor assumes you run, such as reviewing your own user accounts or using single sign-on. Read the list and check you actually do them. Auditors write them because the vendor's controls do not work without them.
Write it up
Record the report period, scope gaps, exceptions that matter, and your own actions. One page is enough. If your own team is preparing for an audit, our guide to the SOC 2 system description shows the other side of this document.
Quick check
Is a SOC 2 Type 1 report enough?
It shows design at one date. For sensitive data, ask for Type 2 or a clear timeline to one.
What does a carved-out subservice organization mean?
Its controls were not tested in this report. Ask for that provider's report or assurance separately.
Sources
Last reviewed: 19 October 2026.
