SOC 2 Report Anatomy: Sections, Opinions and How Exceptions Are Reported

A SOC 2 report is long and formatted for people who already know where to look. Reviewers who start on page one and read straight through often miss the three things that matter: what the opinion covers, what was excluded from scope, and which tests produced exceptions. This guide goes through the report part by part and then shows how to read the results of a control test.

For the difference between Type 1 and Type 2 see SOC 2 Type 1 vs Type 2. For comparison with the other SOC reports, see SOC 1 vs SOC 2 vs SOC 3. This page explains the standard so a reader can interpret a report.

What is in a SOC 2 report?

A SOC 2 report is an examination report from a service auditor under the AICPA attestation standards, AT-C 105 and 205, measured against the Trust Services Criteria. The AICPA's illustrative SOC 2 Type 2 report lists four components: management's assertion, a description of the system, the service auditor's report, and tests of controls and their results. The system description is written against the AICPA's description criteria in DC section 200, which do not prescribe a format, so organizations arrange the material differently. Many reports carry an optional section for other information from management.

A common layout is:

The Trust Services Criteria behind the controls

The criteria are in five categories: security, availability, processing integrity, confidentiality and privacy. Security is always included, and its common criteria are numbered CC1 to CC9: control environment, communication and information, risk assessment, monitoring, control activities, logical and physical access, system operations, change management and risk mitigation. Availability, processing integrity, confidentiality and privacy have their own additional criteria (A1, PI1, C1 and P1 to P8). The criteria are in TSP section 100, 2017, with revised points of focus issued in 2022. Points of focus are guidance, not requirements, and the 2022 revision did not change the criteria themselves.

The opinion

In a Type 2 report, the service auditor's opinion has three parts:

1. whether the description fairly presents the system that was designed and implemented throughout the period
2. whether the controls stated in the description were suitably designed to provide reasonable assurance that the service commitments and system requirements would be achieved based on the applicable criteria, if the controls operated effectively
3. whether those controls operated effectively throughout the period to provide that assurance

A Type 1 report has the first two parts, as of a point in time.

An opinion can be unmodified, qualified, adverse or a disclaimer. Qualifications generally arise when the description is not fairly presented, a control is not suitably designed, a control did not operate effectively for some or all of the period, or the auditor could not obtain evidence. The basis-for-opinion section explains which of these applies and which criteria are affected.

How exceptions are reported

An unmodified opinion does not mean there were no exceptions. The service auditor tests each control and reports the result in the tests section. When a test finds a deviation, the report describes it and the number of items tested and the number with exceptions. The auditor then decides whether the deviation means the criterion was not met. If other controls meet the criterion or the deviation was isolated, the opinion can remain unmodified, with the exception described. If the deviation means the criterion was not met, the opinion is qualified for that criterion.

Management's responses to exceptions usually appear in the other information section, which the service auditor does not opine on.

Worked example (illustrative): reading an exception

An illustrative Type 2 report covering security for January 1 to December 31, 2026 includes this result.

The service auditor's report is unmodified. The reason, from the report: another control under CC6.3 requires quarterly access reviews, which were tested without exceptions, and neither of the two accounts was used after termination.

How a reader interprets it:

• Rate. 2 of 25 is 8% of the sample. The sample is not the population, and the report does not conclude on a population error rate.
• Mitigation. The quarterly review is a second control over the same risk. The reader checks that the report says that control was tested and what it covered.
• Relevance. A customer deciding whether to give the provider access to sensitive data weighs the exception against that risk. An auditor deciding whether the provider's controls support a financial statement audit does not use a SOC 2 for that purpose, because it does not address financial reporting controls.
• Follow-up. The reader asks the provider what changed. A remediation date before year end is more comforting than one after the report period.

If the same result had been 10 of 25 and no other control addressed it, the report would likely qualify the opinion for CC6.2.

Carve-outs, subservice organizations and complementary user entity controls

• Subservice organizations. If the service organization uses a subservice organization such as a data center, the description either includes its controls (inclusive method) or excludes them (carve-out method) and lists the complementary subservice organization controls it expects. See subservice organization.
• Complementary user entity controls. The description lists controls the customer must have for the criteria to be met, such as approving user access. See complementary user entity controls.
• Scope exclusions. Services, locations or systems not in the description are not covered, even if the provider uses the same brand name.

How to read a report efficiently

1. Read the service auditor's report first: opinion, categories, period, modifications.
2. Check the scope against what you buy and where it runs.
3. Read management's assertion and check that it matches the opinion's scope.
4. Skim the system description, focusing on subservice organizations and complementary user entity controls.
5. Read every test result marked as an exception or deviation.
6. Read the other information section as management's views, not as audited statements.
7. Map complementary user entity controls to your own controls. A review checklist can help.

Mistakes to avoid

• Stopping at "unqualified opinion" without reading the exceptions.
• Assuming the report covers every product or location from the same provider.
• Missing the gap between the end of the report period and today.
• Treating management's responses in the other information section as audited.
• Using a SOC 2 to support financial reporting reliance.

Frequently asked questions

What sections does a SOC 2 report have?

A service auditor's report, management's assertion, a description of the system, and for a Type 2 report the criteria, controls, tests and results, often with an optional section of other information from management.

Can a SOC 2 report have exceptions and still be clean?

Yes. The opinion can be unmodified while the tests section reports deviations, provided the service auditor concludes the criteria were still met.

What is a qualified SOC 2 opinion?

An opinion that says the description, design or operation is fairly stated or effective except for a specified matter, such as a criterion where controls did not operate effectively.

Does a SOC 2 report cover financial reporting controls?

No. It covers controls relevant to the trust services criteria. A SOC 1 report addresses controls relevant to user entities' internal control over financial reporting.

Sources

• AICPA, Illustrative SOC 2 Type 2 report with description and assertion (components of the report; DC section 200 does not prescribe format): https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion
• AICPA, 2017 Trust Services Criteria with Revised Points of Focus, 2022 (TSP section 100): https://www.aicpa-cima.com/resources/article/2017-trust-services-criteria-with-revised-points-of-focus-2022
• AICPA, AT-C Section 105 and AT-C Section 205
• AICPA, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (guide)

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error