How to read a supplier’s SOC 2 report in ten minutes

A Type 1 reports on whether controls were suitably designed and implemented as at a single date. A Type 2 also reports on whether they operated effectively across a period. Only the second is evidence that anything actually ran.

This is a thirty-second check that occasionally ends the review, and it is missed regularly because both documents are titled SOC 2 and look identical from the cover. If you asked for a SOC 2 meaning a Type 2 — which is what most vendor questionnaires intend — and received a Type 1, you have a report about intentions.

It is not nothing: a Type 1 from a real CPA firm tells you controls were designed and in place. But it cannot support a conclusion about operation, and filing it as though it could is the quiet version of not doing the review.

The scope of a SOC 2 is set by the service organisation, through the system description and which Trust Services Criteria categories it selected. That latitude is legitimate and it is why scope deserves your attention more than the opinion does.

Read the system description and answer one question: does this cover the specific product, platform or service we are buying? Large suppliers frequently have reports covering one platform and not another, or covering a core service while the module you are adopting sits outside it. The report is entirely valid and tells you almost nothing about your purchase.

Then check which criteria categories are included. Security, through the common criteria, is in every SOC 2. Availability, Processing Integrity, Confidentiality and Privacy are optional. If uptime is the thing you are relying on and Availability was not in scope, the report does not speak to it — and a supplier selecting only Security is making a reasonable choice that your review has to account for.

First, the testing section — controls, tests performed, results. This is where the report says what actually happened, and it is where exceptions live. Two things surprise reviewers: exceptions can appear under an unqualified opinion, and a qualified opinion is usually confined to one area rather than being a general failure. So neither the opinion paragraph alone nor the word "qualified" alone tells you enough. Read the exceptions and read management’s response to each one, which is where you find out whether the issue is fixed, being fixed, or accepted.

Second, the complementary user entity controls — the CUECs. This is a list of controls the report assumes YOU operate, without which the supplier’s controls cannot achieve what they claim. Configuring access in their console, managing your own users and offboarding, enabling the features that make their assurances true, reviewing the logs they expose.

The CUEC list is the most consequential page in the document for a customer, because it is the part that transfers work to you, and it is almost never read by whoever files the report. Extract it, assign each item an owner in your organisation, and treat any you cannot honestly claim as a gap in your controls rather than theirs. An auditor reviewing your third-party management will ask about exactly this.

Most services run on other services, and the report handles that in one of two ways worth telling apart.

Under the inclusive method, the subservice organisation’s controls are in scope and are tested alongside the supplier’s own. Under the carve-out method — much more common — they are excluded from testing, and the report instead discloses complementary subservice organisation controls: the controls the supplier expects its provider to operate.

The distinction matters because a carve-out disclosure is a representation, not a tested assertion. Your supplier is saying it has a basis to expect those controls exist; the auditor did not examine them. So if your supplier carved out its cloud provider, the report tells you nothing tested about that provider, and the assurance chain continues one link further than the document covers.

That is usually fine and usually resolvable — major providers publish their own reports. But it means "they have a SOC 2" is a statement about one layer, and knowing which layers were carved out is part of knowing what you actually verified.

A Type 2 covers a period that has closed, and reports are issued some months after that. A report you receive today might cover a window that ended a year ago, which means your assurance is about a version of the supplier that may no longer exist.

The usual bridge is a bridge letter, sometimes called a gap letter, covering the interval between the period end and your own date. Know what it is worth: it is issued and signed by the supplier’s management, not their auditor, because the CPA firm’s attestation is limited to the period examined. It asserts the controls are still operating and discloses material changes, and it typically covers up to about three months.

So a bridge letter is the supplier’s own assertion stretched over the gap. Accept it for a short interval, and treat a long gap with only a bridge letter as what it is: an unaudited claim about the most recent period, which happens to be the period you care about most.