How do you read a SOC 2 report?

Read the CPA firm's opinion first, then check the period or date it covers, then the scope: the criteria in scope and whether the product you buy is inside the system boundary. After that, look at the subservice organizations (carved out or included), the complementary user entity controls you are expected to run, and the exceptions in the test results. Treat any management response in the last section as unaudited context. Then record your decision in a vendor review record.

What should I look at first in a SOC 2 report?

The independent auditor's report. Compass and Scrut both say to read it first, and Agency lists it first and calls it the most important section. Confirm that a licensed CPA firm issued it, note the report type and the period end date or Type I date, and see which opinion it carries. The management assertion is the company's own statement and does not replace the auditor's opinion.

How old can a vendor's SOC 2 report be?

The sources give different rules of thumb. Compass says a report whose period ended more than six to twelve months ago may no longer reflect the vendor's environment. Agency and Scrut treat a period that ended more than twelve months ago as a red flag. None of these is a criterion, so decide your own limit, write it in your vendor policy and ask for a newer report or a bridge letter when a report is older than that.

What does carve-out mean in a SOC 2 report?

Agency describes the carve-out method as one where a subservice organization, such as a cloud provider, is excluded from the testing in the report, so its controls are not tested there and you may need its own report. Under the inclusive method the subservice organization is part of the service organization's scope. Check which method the report uses for each subservice organization your data passes through.

What should I do about exceptions in a vendor's SOC 2 report?

Do not treat an exception as an automatic reason to reject the vendor, and do not skip it because the opinion is unqualified. For each one, find the control and criterion, the size of the sample, whether the same failure repeats across periods, and what the vendor did about it. Then decide whether it touches the data and services you use, and record the decision and who accepted any remaining risk.

Is the management response in a SOC 2 report audited?

No. Compass describes the final section as optional and not audited, and says it often holds management's responses to exceptions. Agency says the auditor's opinion does not cover that section. Read it as the vendor's explanation. It can tell you what the vendor plans to fix, but the CPA firm has not tested it.

Does a clean SOC 2 report mean the vendor is safe to use?

No. A SOC 2 report is a CPA firm's opinion on a stated system, against stated criteria, for a stated period. It says nothing about a product outside the system boundary, a control the vendor expects you to run yourself, or the months since the period ended. Agency lists relying only on the opinion and treating SOC 2 as pass or fail among the common reading mistakes.

How to read a SOC 2 report: a checklist for vendor reviews

Updated 25 October 2026

Read a SOC 2 report in the order the CPA firm built it, and start with the auditor's opinion. Check who issued it and which opinion it carries, then the period it covers and how old that period is, then whether the criteria and the product you use are in scope. After that, look at the subservice organizations, the controls the vendor expects you to run (CUECs) and the exceptions in the test results. Treat the vendor's own commentary in the last section as unaudited. Then write down what you decided and why. This guide takes each step in turn, shows where the published sources disagree, and ends with a checklist you can keep in your vendor review record.

The five sections in order, and what each is for

A SOC 2 report is written by a licensed CPA firm after it examines a service organization's controls against the Trust Services Criteria. It is an attestation report, not a certificate (see is SOC 2 a certification?), so you are reading an opinion and its supporting detail, not looking for a stamp. Compass IT Compliance, Scrut and Agency describe the same five-part order (Compass) (Scrut) (Agency):

Section	What it is for
1. Independent auditor's report	The CPA firm's opinion, the standards used, and the period (Type II) or date (Type I).
2. Management's assertion	The company's own signed statement that its description is fair and its controls were designed as described.
3. System description	The services, the system boundary, the people, procedures and data, and usually the subservice organizations and CUECs.
4. Criteria, controls, tests and results	Each criterion mapped to controls and, for Type II, the auditor's tests and what they found.
5. Other information	Optional material from management, such as responses to exceptions. Not audited.

Headings and numbering differ from report to report, so use the table of contents of the report in front of you. The sources also place the CUEC and subservice lists differently: Compass puts them inside the controls and results section, while Scrut puts them in the system description. Search the whole PDF for both.

Read the opinion first, and check who issued it

Scrut's review guide tells readers to read the auditor's opinion before anything else (Scrut). Compass adds a check on the author: confirm that a licensed, independent CPA firm prepared the report, and not a software tool (Compass). Scrut's report overview makes a related point. A document that holds only the management assertion and no CPA opinion is not a SOC 2 report, because the assertion is a self-declaration and the opinion is what validates it (Scrut).

Then note the opinion. The four kinds (unqualified, qualified, adverse and disclaimer) are set out in is SOC 2 a certification?. Scrut and Agency treat an unqualified opinion as the baseline a reviewer hopes to see, and the sources differ on how they describe a qualified one. Agency describes it as material exceptions in specific areas, with the overall environment still effective, and Scrut's report overview as one or more criteria not fully met (Agency) (Scrut). Compass says only that it warrants a closer look at the details behind it (Compass). Whatever the label, go and read which controls and criteria are affected. Scrut's review guide suggests assessing the exceptions against the data and services involved for a qualified opinion and escalating an adverse opinion as a formal risk (Scrut).

Check the period and the age of the report

Type I covers the design of controls on one date. Type II covers design and operation over a period. Compass notes that a Type I report gives no evidence that controls were followed in practice (Compass). For a Type II report, find the period end date and ask two questions: how long was the period, and how long ago did it end? The sources do not give one answer.

Source	What it says
Compass IT Compliance (3 Aug 2026)	A period that ended more than six to twelve months ago may not reflect the current environment. Type II periods are typically three, six or twelve months.
Agency	The period should end within the last twelve months. A period that ended earlier is a red flag. It prefers six to twelve months and says at least six.
Scrut (review guide)	Reports are generally considered current for twelve months from the end of the audit period. A Type II window of only three to four months gives significantly less assurance.

These are the sources' rules of thumb, and they are not criteria in the Trust Services Criteria. Pick a limit for your own reviews and write it into the vendor policy. When a report is older than your limit, ask the vendor for a newer one. Compass suggests a bridge letter for the gap (Compass). Remember what that letter is: a bridge letter is management's statement about the time since the period ended, not a new opinion from the CPA firm.

Does the scope match what you use?

Three scope checks, each from the sources:

Criteria in scope. Security is in every SOC 2 report; the other four categories are optional (see SOC 2 scope). Compass gives examples of matching them to your risk: Confidentiality for a vendor that stores customer data, Availability for a vendor that supports high-availability applications, Privacy where personal data of EU residents is processed (Compass). Scrut treats a missing Privacy or Confidentiality category as a gap when the vendor handles personal or sensitive data (Scrut).
The product you buy. Agency notes that a company with several products may scope only some of them, so confirm that the specific service you use appears in the system description (Agency).
The system boundary. Scrut's report overview says anything outside the description, including cloud environments that are not listed, gets no assurance (Scrut). Check that the data you send and the features you use sit inside it.

Subservice organizations: carved out or included

Most vendors run on a cloud provider and other services. The report says how it treats them. Agency describes two methods (Agency). Under carve-out, the subservice organization is excluded from the testing in this report, so its controls are not tested there and you may need to read its own report. Under the inclusive method, it is included in the service organization's scope. Compass explains the same part of the report through CSOCs, the controls the vendor relies on its subservice organizations to perform, and calls the list a responsibility matrix (Compass). Compass does not explain carve-out against inclusive, so this page takes that point from Agency alone.

For your vendor review, list each subservice organization, whether it is carved out or included, and whether the one that holds your data has a report of its own. That list is your picture of who handles your data after the vendor does. CUECs and CSOCs are different lists: the first goes into your own controls and the second into your vendor inventory, as the CUEC guide explains.

CUECs: the controls you are expected to run

Complementary user entity controls are the controls the vendor's report assumes its customers operate. Examples in the sources include enforcing MFA, adding and removing your own users, and protecting credentials and API keys (Agency). Read the list, decide for each one whether it applies to how you use the service, and map it to a control you already run. The CUEC guide walks through the mapping step by step, so it is not repeated here. One point from Scrut belongs in the review: a CUEC set that is excessive or unrealistic can shift security accountability onto you, and the source counts that as a red flag (Scrut).

Exceptions in the test results

An exception is a control that did not operate as designed during the period. Agency says exceptions are documented whatever their severity and that a report with an unqualified opinion can still list them (Agency). So the opinion is not enough: read the results. Compass describes three result labels in the controls and results section (Compass):

Label (Compass wording)	What it means
No deviations or exceptions noted	The control operated as intended in every sampled instance.
Deviations or exceptions noted	The control did not operate as designed in one or more instances.
No instances of occurrence	The control could not be tested because the event that triggers it did not happen in the period.

Wording varies by firm. Scrut's report overview does not give a fixed set of labels, so read how your report words its results (Scrut). The third label is easy to misread: nothing was tested, so it is not evidence that the control works. Compass uses a disaster recovery test that was not scheduled in the window as its example.

For each exception, ask the vendor or check the report for these:

Which control and criterion? Agency says exceptions in access management and data protection deserve more attention than documentation gaps (Agency).
How big was the sample, and how many failed? Scrut tells readers to look at testing procedures and sample sizes (Scrut).
One-off or repeated? Scrut separates an isolated exception with documented remediation from the same exception recurring across audit cycles, which it lists as a red flag.
What was done, and by when? Scrut recommends asking for a remediation timeline.
Does it touch what you use? An exception in a feature you do not use matters less than one in the control that protects your data. Write down why.

Management responses in the last section are not audited

The final section is the vendor's own space. Compass describes it as optional and not audited, and says it often holds management's responses to exceptions and mappings to other frameworks (Compass). Agency says the auditor's opinion does not cover it, and advises reading it as context and not as audited evidence (Agency). Agency separates this from corrective actions noted inside the exception findings, which you should check against the details of the exception. Compass offers a view of the value: a well-documented exception with a credible plan can show more about a vendor's maturity than a report with no exceptions. That is Compass's opinion, and a plan the CPA firm has not tested is still only a plan.

Record the decision in your vendor review record

Reading the report is half the job. The other half is the record, because that is what an auditor samples when they test how you manage vendors (criterion CC9.2). The Vendor and Third-Party Risk Management Policy sets the rule. The statements below are rendered from the policy template for the Northwind Cloud Inc sample intake, so they change when the template does.

Section 5.2: Due diligence. For Tier 1 vendors, the Security Owner obtains the current SOC 2 Type II report or ISO 27001 certificate, reviews scope, opinion, exceptions and complementary user entity controls, sends the Northwind Cloud Inc questionnaire where gaps remain and documents the data flow with Engineering; Tier 2 vendors need an assurance report or completed questionnaire. Findings and the final tier are recorded.

Section 4.13: Residual risk from a vendor that cannot meet its tier's requirements is recorded in the risk register and accepted in writing, with an expiry date and compensating measures, by Executive Management for Tier 1 and the Security Owner for Tier 2 and Tier 3.

Keep one row per check, with the answer and the evidence:

Check	What to record
Issuer and opinion	CPA firm name, report type, opinion, and the date you received the report.
Period or date	Start and end dates, and whether they fall inside your own age limit.
Scope	Criteria in scope, the product you use, and any data or feature outside the boundary.
Subservice organizations	Each one, carved out or included, and whether you hold its report.
CUECs	Each one, whether it applies, the control you run, the owner and where the evidence lives.
Exceptions	Each exception, your assessment, and any remediation the vendor committed to.
Decision	Accept, accept with conditions, ask for more, or escalate. Reviewer, date, and next review.

The free vendor review template builds a draft record per vendor you name, with the checklist from the policy, a suggested tier and a CUEC line for each. The vendor reports guide shows where each vendor publishes its report. If a vendor has no report to read, the vendor security questionnaire is the next thing to ask for, and the record should say which evidence you relied on.

If you are the company being reviewed

Your customers will run this same checklist on your report: who issued it, how current it is, what is in scope, which subservice organizations you carve out, which CUECs you assign them and what your exceptions are. Write your system description with those questions in mind, and do not leave scope vague. If you do not hold a report yet, see what to send when a customer asks and answering a questionnaire without a report. The Audit Kit ($59, one time) puts the 22 policies in your company's name, adds vendor review records and drafts a system description with a CUEC section, so your own report has something accurate to describe. A report still comes only from a CPA firm.

Frequently asked questions

How do you read a SOC 2 report?: Read the CPA firm's opinion first, then check the period or date it covers, then the scope: the criteria in scope and whether the product you buy is inside the system boundary. After that, look at the subservice organizations (carved out or included), the complementary user entity controls you are expected to run, and the exceptions in the test results. Treat any management response in the last section as unaudited context. Then record your decision in a vendor review record.
What should I look at first in a SOC 2 report?: The independent auditor's report. Compass and Scrut both say to read it first, and Agency lists it first and calls it the most important section. Confirm that a licensed CPA firm issued it, note the report type and the period end date or Type I date, and see which opinion it carries. The management assertion is the company's own statement and does not replace the auditor's opinion.
How old can a vendor's SOC 2 report be?: The sources give different rules of thumb. Compass says a report whose period ended more than six to twelve months ago may no longer reflect the vendor's environment. Agency and Scrut treat a period that ended more than twelve months ago as a red flag. None of these is a criterion, so decide your own limit, write it in your vendor policy and ask for a newer report or a bridge letter when a report is older than that.
What does carve-out mean in a SOC 2 report?: Agency describes the carve-out method as one where a subservice organization, such as a cloud provider, is excluded from the testing in the report, so its controls are not tested there and you may need its own report. Under the inclusive method the subservice organization is part of the service organization's scope. Check which method the report uses for each subservice organization your data passes through.
What should I do about exceptions in a vendor's SOC 2 report?: Do not treat an exception as an automatic reason to reject the vendor, and do not skip it because the opinion is unqualified. For each one, find the control and criterion, the size of the sample, whether the same failure repeats across periods, and what the vendor did about it. Then decide whether it touches the data and services you use, and record the decision and who accepted any remaining risk.
Is the management response in a SOC 2 report audited?: No. Compass describes the final section as optional and not audited, and says it often holds management's responses to exceptions. Agency says the auditor's opinion does not cover that section. Read it as the vendor's explanation. It can tell you what the vendor plans to fix, but the CPA firm has not tested it.
Does a clean SOC 2 report mean the vendor is safe to use?: No. A SOC 2 report is a CPA firm's opinion on a stated system, against stated criteria, for a stated period. It says nothing about a product outside the system boundary, a control the vendor expects you to run yourself, or the months since the period ended. Agency lists relying only on the opinion and treating SOC 2 as pass or fail among the common reading mistakes.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.