How to Review a Supplier’s SOC 2 Report

Asking a supplier for its SOC 2 report is the easy part. Reading it properly is where most vendor reviews fall short. The report is long, written for auditors, and the details that matter most are rarely on the first page. This is how to review one in a way that stands up in your own audit.

Short answer

Check five things: the auditor’s opinion, the scope and the period, how subservice providers are treated, the complementary user entity controls you are expected to run, and the exceptions in the test results with management’s responses. Then record what you found, what you will do about it, and when you will look again.

The structure of a SOC 2 report

The review, step by step

1. Read the opinion. An unqualified opinion is clean. A qualified, adverse or disclaimed opinion needs a conversation before you go further.
2. Check the type and period. Type II gives evidence of operation over time; Type I covers design on one date. Note when the period ended and whether a bridge letter covers the gap.
3. Check the scope. Make sure the service you actually buy, and the locations and systems behind it, are in the system description. Note which Trust Services Criteria are included.
4. Look at subservice organisations. If the cloud provider is carved out, the report relies on that provider’s own controls. Decide whether to obtain its report too.
5. List the complementary user entity controls. These are your responsibilities. Map each one to a control you already run, or fix the gap.
6. Read the exceptions. Not every exception is serious. Look at which controls are affected, how often, and how management responded.
7. Record the outcome. Note the risk rating, actions and next review date in your supplier register.

Red flags

• A scope that excludes the service or location you use.
• Exceptions in access removal, change approval or logging, especially repeated ones.
• A report period that ended more than about a year ago, with no bridge letter.
• A carved-out subservice provider holding your data, with no evidence of its own assurance.
• Complementary controls your team did not know about.

Where this fits in ISO 27001

ISO 27001 expects supplier relationships to be managed through the Annex A supplier controls, and a supplier’s SOC 2 report is one of the most useful pieces of evidence for that. Reviewing it properly, recording the result and following up on actions is exactly what an ISO 27001 auditor wants to see. Our risk assessment and Statement of Applicability guide covers where supplier risk sits in the system.

How Streamline helps

We help businesses build supplier review into their ISO 27001 system, including a practical way to read and record SOC 2 reports. We are independent of the CPA firm that issues the report, so we prepare you properly rather than marking our own homework, and we usually build on an ISO 27001 foundation so the same work supports both. Read about our SOC 2 readiness and advisory or talk to us about SOC 2.

More on SOC 2

• The SOC 2 guide: what it is and how it works
• SOC 2 cost in Australia
• SOC 2 readiness assessment and checklist
• How to choose a SOC 2 auditor
• SOC 2 bridge letters
• ISO 27001 vs SOC 2

Frequently asked questions

What is the most important part of a SOC 2 report?

Start with the auditor’s opinion, then the scope and period, then the exceptions in the test results. A clean opinion with a scope that does not cover the service you buy is of little use.

What are complementary user entity controls?

Controls the service organisation expects its customers to operate, such as managing their own user access or reviewing their own logs. If you do not run them, the assurance in the report does not fully apply to you.

What does carve-out mean?

The report excludes a subservice organisation, such as the cloud provider, and relies on that provider having its own controls. You may need to obtain and review that provider’s report too.

How often should we review a supplier’s SOC 2 report?

At onboarding and then each year when the new report is issued, with a bridge letter for any gap. Record the review and any follow-up actions as part of your supplier management.