Short answer: To read a SOC 2 report, start with the auditor’s opinion and the period covered, then check the scope and Trust Services Categories, read the test results for exceptions, and finish with subservice organizations and the complementary user entity controls (CUECs) you are expected to run. Skim the long system description last.
A SOC 2 Type II report can run to 80 pages or more. Most reviewers do not read it front to back, and they should not. The useful information is concentrated in a few places, and a report can look impressive while hiding a problem in a short paragraph. Knowing where to look turns a week of vendor review into an afternoon.
This guide is written for two audiences. If you are reviewing a vendor’s report, it tells you what to check. If you are a service organization preparing your own, it shows what your customers will focus on.
What is in a SOC 2 report?
SOC 2 reports usually follow a familiar structure. Layouts differ between audit firms, but you will typically find these sections:
| Section | What it contains | Why it matters |
|---|---|---|
| 1. Independent service auditor’s report | The auditor’s opinion, scope, period and responsibilities | Tells you whether the opinion is clean or modified |
| 2. Management’s assertion | A statement from the company that the description is fair and controls were effective | Confirms what management is formally claiming |
| 3. System description | How the service works, its boundary, people, data, subservice providers and CUECs | Shows whether the system matches what you are buying |
| 4. Controls, tests and results | Each control, the test performed and the outcome (Type II) | Where exceptions appear |
| 5. Other information | Optional management content, such as responses to exceptions or business continuity details | Context from management, not audited |
The standards behind these reports come from the AICPA, and its page on the SOC suite of services gives the official background.
A practical reading order
1. Confirm the report is current and the right type
Check the report type, the period covered and who issued it. A Type I describes controls at one date. A Type II covers a period and tests operating effectiveness. Look at the period end date to judge age. If it is more than about a year old, ask for a newer one or a bridge letter, and see our note on how long a SOC 2 report is valid.
2. Read the auditor’s opinion
Find the opinion paragraph. An unqualified opinion is the clean outcome. A qualified, adverse or disclaimer opinion is a red flag that needs explanation. Our article on a qualified SOC 2 opinion explains the differences.
3. Check scope and categories
Does the report cover the product you are buying? Which Trust Services Categories are included? Security is always present. If you rely on uptime, you want Availability. If you store sensitive business data, you want Confidentiality. A good report in the wrong scope does not help you. Read more on how SOC 2 scope is defined.
4. Go straight to the test results
In section 4, scan the results column for anything other than “no exceptions noted”. Read every exception in full: what control failed, how many samples were tested, how many failed and how management responded. A single exception in an unrelated control matters less than repeated failures in access control or change management.
5. Review subservice organizations
Find the cloud provider, payment processor or other third parties the vendor depends on. See whether they are carved out or included. With carve-out, the provider’s controls are described but not tested, so you should also review the provider’s own report. Our article on subservice providers explains why this matters.
6. Read the CUECs
Complementary user entity controls are controls the vendor assumes you, the customer, will operate. Examples include reviewing your own user accounts, protecting your credentials and notifying the vendor of terminated users. They usually sit near the end of the system description. If you do not run them, the vendor’s controls may not protect you the way the report suggests.
7. Skim the system description
Finally, read the description for the parts that affect you: where data is stored, how access is controlled, how incidents are handled and what changed during the period. It is long, but if you have done steps 1 to 6 you know what to look for.
Reviewer checklist
- Report type, period and issuing CPA firm are stated.
- Period ended within your accepted window.
- Opinion is unqualified, or modifications are understood.
- The in-scope system matches the service you buy.
- Needed Trust Services Categories are included.
- Every exception has been read and assessed.
- Subservice organizations are identified and their reports obtained if needed.
- CUECs are listed and assigned to owners on your team.
- Management’s responses are noted but treated as unaudited.
Red flags
- A report period that is very short, with key annual controls not exercised.
- A scope that quietly excludes the part of the product you use.
- Repeated exceptions in access reviews, change management or incident response.
- Heavy reliance on carved-out providers with no mention of their reports.
- A long list of CUECs that nobody has mapped to an owner.
- Vague or evasive management responses.
If you are the vendor: what readers will focus on
Prepare for the same scrutiny. Make sure the system description is accurate and updated, the exceptions have a credible management response and your CUECs are realistic. Share the report in a controlled way, which our guide to sharing SOC 2 reports with clients explains. For a high-level view of how buyers weigh a report, see how customers evaluate SOC 2.
Common mistakes when reviewing a report
- Counting controls. A long list does not mean strong coverage. Look at results, not volume.
- Stopping at “we have a SOC 2”. The existence of a report says nothing about its opinion, scope or exceptions.
- Ignoring CUECs. They are your responsibilities, and they are easy to overlook.
- Treating a SOC 2 report as a certification. It is an auditor’s attestation about a system over a period.
- Trusting section 5 as audited. Management’s additional information is not covered by the auditor’s opinion.
Business implications
For buyers, careful reading shortens vendor onboarding and avoids hidden risk. For vendors, understanding the reader’s path lets you design a report that passes review on the first pass. If you are preparing your first report and want to know what reviewers will see, SOC 2 Type I and Type II audit support from SOC2.in can help you get there. For the broader family of reports, see Understanding AICPA SOC reports.
A fifteen-minute workflow for reviewing a vendor’s SOC 2 report
If you are on the buying side, you do not need to read every page to get value. This order of review surfaces most of what matters.
- Check the cover and period. Is it Type I or Type II? When did the period end, and is that recent enough for your policy?
- Read the opinion first. Unqualified, qualified, adverse or disclaimer? Anything other than unqualified deserves a direct conversation.
- Confirm the scope. Does the system description cover the product, features and regions you will use? Are the trust categories you care about included?
- Find the subservice organizations. Note which are carved out and whether you need to review their reports separately.
- Read the complementary user entity controls. These are tasks the vendor expects you to perform. Assign each to an owner on your side.
- Scan the tests of controls for exceptions. Read the auditor’s description and the management response, and judge whether the issue touches your risk.
- Write down open questions and send them to the vendor in one batch.
Red flags
- A scope that quietly excludes the service you are buying.
- Many exceptions in access control or change management.
- A report issued by a firm you cannot verify as a licensed CPA firm.
- A period that ended long ago with no bridge letter or newer report planned.
Treat the report as one input to your vendor risk process. It does not replace contract terms or your own due diligence. Our guide to third-party risk management shows how to fit it into a wider program.
Frequently asked questions
How do you read a SOC 2 report?
Check the type and period, read the auditor’s opinion, confirm scope and categories, review test results for exceptions, then examine subservice organizations and CUECs. Read the system description last.
What are CUECs in a SOC 2 report?
Complementary user entity controls are controls the service organization expects its customers to implement for the vendor’s controls to work as designed.
Where do I find exceptions in a SOC 2 report?
In the section that lists controls, tests performed and results. Look for any result other than no exceptions noted.
What is the most important part of a SOC 2 report?
The auditor’s opinion, scope and test results matter most. The system description is long but is best read after you know what you are looking for.
Is section 5 of a SOC 2 report audited?
No. It is additional information from management, such as responses to exceptions, and sits outside the auditor’s opinion.
How old can a SOC 2 report be?
There is no official limit. Many organizations accept reports that ended within the last 12 months, and ask for a bridge letter for short gaps.
Conclusion
A SOC 2 report is easier to read once you know what matters: current period, opinion, scope, exceptions, subservice providers and CUECs. Use the order above, ask follow-up questions where the report is unclear and treat management commentary as context, not proof. The same lens will help you build a stronger report of your own.
