What do auditors ask for when they test vendor management?

Criterion CC9.2 expects you to assess and manage the risk from vendors. The auditor usually takes the vendor inventory, samples a few vendors (critical ones first) and asks for the review record of each: the tier, the assurance report you obtained, what you found in it, the CUECs you operate, the contract terms and the decision, with a date and a reviewer that fall inside the audit period.

Do we need a review for every tool the company uses?

Every vendor goes in the inventory, but the depth of the review follows the tier your vendor policy sets. Vendors that store or process customer data get a full review with an independent report; low-risk tools need the tier confirmed and standard terms. The auditor checks that you applied your own rule consistently.

The vendor has no SOC 2 report. What do we record?

Ask for an equivalent first: an ISO 27001 certificate with its statement of applicability, or a recent penetration test summary. If there is nothing independent, send the vendor security questionnaire and keep the completed answers. Record which evidence you relied on, any gaps, and who accepted the remaining risk.

What is a bridge letter and when do we need one?

A SOC 2 Type II report covers a period that ended before you read it. A bridge letter is the vendor management's statement that nothing material changed from the end of that period to a later date. Ask for one when the report period ended more than about three months before your review.

Why are some vendors marked Assign at review?

The suggested tier comes from what the generator answers say about the tool, using the same rule as the vendor inventory in the Audit Kit's registers. Hosting, source control, the identity provider, CI/CD and backups hold customer data or production access, so they start as Tier 1. For logging tools and the vendors in your list, the answers do not say what data they receive, so you assign the tier when you review them.

Does this pack say our vendors were reviewed?

No. Every record is a draft that lists what the policy requires and leaves each finding, date, reviewer and decision as a [Fill in] placeholder. It becomes evidence only once someone has read the vendor's report and contract, filled it in and signed it.

Vendor review template for SOC 2

Updated 23 October 2026

Your vendor policy requires a review of each vendor at onboarding and on a schedule, and the auditor samples those reviews. This page builds one draft review record per vendor you named in the generator: what it does for you, a suggested tier with the reason, where to get its SOC 2 report, and the checklist your Vendor and Third-Party Risk Management Policy requires, quoted with section numbers. Add any other vendor by name. Word and Excel, built in your browser: no signup, nothing uploaded.

Vendor review pack: Northwind Cloud Inc

One draft review record per vendor, with the checklist your vendor policy requires. Vendors you add stay in this page’s address (after the #), so you can bookmark it. Built in your browser; nothing is uploaded.

No generator answers found in this browser, so the pack uses the sample company, Northwind Cloud Inc. Answer the 23 generator questions to start from your own tools.

12 vendors

AWS
Cloud hosting for the product · Tier 1 - Critical (suggested)
Vercel
Cloud hosting for the product · Tier 1 - Critical (suggested)
GitHub
Source code and code review · Tier 1 - Critical (suggested)
Okta
Identity provider and single sign-on · Tier 1 - Critical (suggested)
GitHub Actions
Build and deployment pipeline · Tier 1 - Critical (suggested)
AWS Backup
Backups · Tier 1 - Critical (suggested)
Datadog
Logging and monitoring · Assign at review
1Password
Password and secret storage for staff · Tier 2 - Important (suggested)
Kandji
Device management · Tier 2 - Important (suggested)
Supabase
[Fill in: what the company uses Supabase for] · Assign at review
Stripe
[Fill in: what the company uses Stripe for] · Assign at review
Slack
[Fill in: what the company uses Slack for] · Assign at review

What auditors look for

SOC 2 criterion CC9.2 asks how you assess and manage risk from vendors and business partners. In practice the auditor takes your vendor inventory, picks a sample weighted toward critical vendors, and asks for each one’s review record. A record that holds up shows:

The tier and why. The data the vendor handles decides the tier, and the tier decides how deep the review goes and how often it repeats.
The assurance report, read. The report type and period, the opinion, the exceptions in the test results and whether they matter for the service you use. A downloaded PDF with no notes shows the report was obtained, not reviewed.
Coverage for the gap. A bridge letter when the report period ended months before the review.
Subservice organizations. The vendor’s own critical vendors, usually carved out of its report, and how they are covered.
The CUECs you operate. See below.
Contract terms, a decision and a date. Security and data processing terms, the decision to continue, change or end the relationship, who made it and when, and the next review date from the tier’s cadence.

What CUECs are

Complementary user entity controls are the controls a vendor’s auditor assumes its customers operate. A SOC 2 report on a cloud provider covers the provider’s data centers and platform; it assumes you manage the users and keys in your own account, turn on MFA and configure encryption and logging for what you build. The report lists these assumptions, usually near the end of the system description.

Your auditor reads the same list. If you rely on a vendor but do not operate its CUECs, the vendor’s report does not cover the risk. Each record in the pack lists typical CUECs for that kind of vendor as a starting point and asks you to replace them with the report’s own list, the person who operates each one and where the evidence is. The sample company’s policy puts it this way (P16 section 4.3): “For Tier 1 vendors, the Security Owner reviews an independent assurance report covering the service used, records exceptions and the complementary user entity controls Northwind Cloud Inc must operate, and documents the data flow and sub-processors.”

The checklist in each record, for the sample company’s AWS

Item	P16	What to record
Report type and period	4.3, 5.2	[Fill in: SOC 2 Type II, SOC 2 Type I, ISO 27001 certificate or questionnaire; period start and end dates; the services in scope.]
Opinion	5.2	[Fill in: unqualified, qualified, adverse or disclaimer, as stated in the auditor's report (section 1 of a SOC 2 report).]
Exceptions noted	4.3, 5.2	[Fill in: each exception in the tests of controls, the vendor's response, and whether it affects the service you use; or the report's own statement that none were noted.]
Bridge letter	4.8, 5.5	[Fill in: bridge letter date and the period it covers, or why one is not needed (report period ended within three months of the review).]
Subservice organizations	4.3, 5.5	[Fill in: the subservice organizations the report names, whether they are carved out or included, and how they are covered (their own reports).]
Complementary user entity controls (CUECs)	4.3, 5.2	[Fill in: each CUEC listed in the report, who at the company operates it, and where the evidence is.]
Data handled	4.1, 5.1	[Fill in: the data stored in it and its classification, for example customer records and production databases.] The intake lists PII among the data the company handles.
Contract and data processing terms	4.4, 4.5	[Fill in: agreement or terms accepted, date and renewal date; whether the security terms P16 lists are present; DPA, BAA or PCI terms where they apply.]
Decision	4.8, 4.13	[Fill in: Continue, Continue with changes, Accept residual risk, End relationship; actions with owners and dates; who approved.]
Next review date	2 (tier table), 5.5	[Fill in: review date] plus 12 months for Tier 1 - Critical.

The P16 column gives the sections of the sample company’s Vendor and Third-Party Risk Management Policy that require the item; the Word file quotes each one in full. When your policy has been edited and a sentence is no longer in it, the record quotes the template wording and says so.

What is in the download

Review records (Word): a summary table, the policy’s tier table and the statements the checklist cites, then a page per vendor with what it does, the suggested tier and reason, where to get its report, the checklist, typical CUECs and a decision and sign-off block.
Tracker (Excel): one row per vendor with a column for each checklist item, lists for assigned tier, report type and decision, reviewer and review date, and a Next review formula: the review date plus the months for the tier, read from the policy’s tier table on its own sheet.

Where a vendor publishes its report comes from our list of where to get your vendors’ SOC 2 reports, checked against each vendor’s own pages. For a vendor not on that list, the record says how to ask for the report, and for a vendor with no independent report, send the vendor security questionnaire.

The Audit Kit includes both files in its vendors folder, built from your answers and the policies as tailored to your tools, next to the vendor inventory in its registers.

Frequently asked questions

What do auditors ask for when they test vendor management?: Criterion CC9.2 expects you to assess and manage the risk from vendors. The auditor usually takes the vendor inventory, samples a few vendors (critical ones first) and asks for the review record of each: the tier, the assurance report you obtained, what you found in it, the CUECs you operate, the contract terms and the decision, with a date and a reviewer that fall inside the audit period.
Do we need a review for every tool the company uses?: Every vendor goes in the inventory, but the depth of the review follows the tier your vendor policy sets. Vendors that store or process customer data get a full review with an independent report; low-risk tools need the tier confirmed and standard terms. The auditor checks that you applied your own rule consistently.
The vendor has no SOC 2 report. What do we record?: Ask for an equivalent first: an ISO 27001 certificate with its statement of applicability, or a recent penetration test summary. If there is nothing independent, send the vendor security questionnaire and keep the completed answers. Record which evidence you relied on, any gaps, and who accepted the remaining risk.
What is a bridge letter and when do we need one?: A SOC 2 Type II report covers a period that ended before you read it. A bridge letter is the vendor management's statement that nothing material changed from the end of that period to a later date. Ask for one when the report period ended more than about three months before your review.
Why are some vendors marked Assign at review?: The suggested tier comes from what the generator answers say about the tool, using the same rule as the vendor inventory in the Audit Kit's registers. Hosting, source control, the identity provider, CI/CD and backups hold customer data or production access, so they start as Tier 1. For logging tools and the vendors in your list, the answers do not say what data they receive, so you assign the tier when you review them.
Does this pack say our vendors were reviewed?: No. Every record is a draft that lists what the policy requires and leaves each finding, date, reviewer and decision as a [Fill in] placeholder. It becomes evidence only once someone has read the vendor's report and contract, filled it in and signed it.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.