What Is in a SOC 2 Report? Each Section Explained

A SOC 2 report is a CPA firm's written opinion on your controls, and it has four main sections plus an optional fifth: the auditor's report, management's assertion, the system description, the criteria with your controls (and, in a Type 2, the auditor's tests and results), and other information from management (BARR Advisory).

The AICPA publishes an illustrative SOC 2 report that shows this structure end to end (AICPA). Firms vary the layout, and some split the content into more parts, such as a separate list of the controls your customers are responsible for (KirkpatrickPrice). The substance is the same everywhere, because every system description is prepared against the same AICPA description criteria.

A report runs to dozens of pages, and most readers do not read it front to back. A buyer's security team reads the opinion first, checks the period and scope, then turns to the exceptions. Knowing what each section says helps you prepare it well and answer questions about it.

The first section is the independent service auditor's report. It names your company, the system examined, the Trust Services Criteria in scope, and either the date (Type 1) or the period (Type 2) the report covers. Then it gives the opinion.

An unqualified opinion, often called a clean opinion, says the system description is fair and the controls were suitably designed and, for a Type 2, operated effectively. A qualified opinion says that was true except for specific matters the auditor describes. An adverse opinion says the controls did not meet the criteria, and a disclaimer means the auditor could not gather enough evidence to form a view.

The opinion is what makes the document an attestation report rather than a self-assessment. Only a licensed CPA firm can sign it, and the firm's name is the first thing a reviewer checks. Choose that firm with care; see how to choose a SOC 2 auditor.

The second section is a short statement signed by your management. In it, your company asserts that the system description is fair and that the controls were suitably designed (and, for a Type 2, operated effectively) to meet the criteria. The auditor's opinion is an opinion on this assertion.

This is a reminder that SOC 2 is your company's report, not the auditor's. Management is responsible for the system description and the controls, and the auditor tests them. Before you sign, read the description closely and make sure it says what you do today. If a statement is wrong, the auditor may have to qualify the opinion, and your name is on the assertion.

The assertion is short, often a page or two, but buyers notice when its scope and dates do not match the rest of the report. Check that the system name, the criteria, and the period are the same in the assertion, the opinion, and the description.

The third section describes the system the audit covers, and it is the part you write, usually with your auditor's help. It follows the AICPA description criteria, known as DC 200, the benchmarks for preparing and evaluating a fair description in a SOC 2 examination (AICPA).

Expect it to cover:

• The services you provide and the boundaries of the system that delivers them.
• Your principal service commitments to customers and the system requirements behind them.
• The components of the system: infrastructure, software, people, procedures, and data.
• Significant changes to the system during the period, for a Type 2.
• Subservice organizations, such as your cloud provider, and whether their controls are carved out or included.
• Complementary user entity controls: the things your customers must do for your controls to work, such as managing their own users' access.
• Incidents during the period that caused you to miss a service commitment.

The subservice and customer-control parts are the ones buyers read most carefully, because they show where your responsibility ends. A clear boundary drawn early also keeps your audit smaller; the SOC 2 checklist covers how to draw it.

The fourth section lists each criterion in scope and the controls you use to meet it. In a Type 1 report the controls are listed without test results. In a Type 2 report each control is followed by the test the auditor performed and the result (BARR Advisory).

A Type 2 test result reads something like this: the auditor inspected a sample of quarterly access reviews from the period and confirmed each was completed and signed off, with no exceptions noted. When a sample fails, the result describes the exception, for example an account that was not removed within the time your policy promised, and management can add a response explaining what happened and what changed.

An exception does not automatically mean a qualified opinion. The auditor judges whether the exceptions stop a criterion from being met, so a report can carry a few exceptions and still have a clean opinion. Buyers still read every one. Access reviews, offboarding, and change management are where exceptions most often appear, so those are the controls to get right first.

The optional fifth section, other information provided by management, can hold material the auditor did not test, such as your plan to fix an exception. Because it is untested, buyers give it less weight.

A buyer's security reviewer checks a few things in order: the opinion, the report type and period, the criteria in scope, the subservice organizations, the controls they are expected to run themselves, and the exceptions. If the period ended more than a few months ago, they ask for a bridge letter from your management covering the time since.

SOC 2 reports are shared under a non-disclosure agreement rather than posted publicly, and the report itself limits who may receive it (Linford & Co). A SOC 3 report is the short, general-use version that can be published, with far less detail.

If you have not bought a report yet, choose the type that matches what your buyers will read. Our recommended path is a security-only SOC 2 Type 2 with a 3-month observation window. A Type 1 is the option when a prospect needs a report in under about 3 months. B2B SaaS companies selling to enterprise teams are asked for the Type 2 sooner or later either way.