Five questions to put to any SOC 2 report you receive.

Length varies a great deal between firms and systems, but the order of the parts does not. Once you know which part holds which answer, a long report becomes a short review.

• A CPA firm signed it. Only a licensed CPA firm can issue the opinion. A document signed by a consultant or a compliance software vendor is not a SOC 2 examination.
• Type 2 when you need operation. A Type 1 looks at design on a single date. A Type 2 tests whether the controls kept working across a review period.
• The period ended recently. There is no expiry date. Buyers judge age from the last day of the period, and commonly expect it to fall within roughly the past year.
• A letter covers the gap. If months have passed since that day, ask for a bridge letter. Management writes it, so it offers comfort but no new audit work.

Between the opinion and the description sits management's assertion. The company's officers sign it to state that their account of the system is accurate and that their controls satisfied the criteria they picked. Treat it as the claim, and the CPA firm's opinion as the independent check on that claim.

• The product you use, or the platform beneath it, is named in the description
• The cloud region or data centre that holds your data is listed
• The trust services categories in scope match your contract: Availability if you hold an uptime promise, Confidentiality if you hand over sensitive business data
• Teams that handle your data, such as support or a separate engineering group, are not described as excluded

A clean opinion arrives without any explanatory paragraph ahead of it. The firm concludes, in all material respects, that management's account is fair and that the controls did their job against the criteria, through the whole period in a Type 2. A qualified, adverse or disclaimed opinion always carries a separate paragraph giving the reason. Our page on opinions covers each form; for this review you only need to spot whether that paragraph is there.

Complementary user entity controls (CUECs)

Steps the vendor assumes its customers take, such as removing their own leavers from the tool. Skip them and part of the assurance never reaches you.

Carved-out subservice organizations

Providers, often the cloud host, whose controls this firm did not test. Their own SOC reports fill that layer.

Inclusive treatment

The less common case where a provider's controls were tested within this same report.

Complementary subservice organization controls

Controls the vendor expects its carved-out providers to run. They tell you which provider reports to request.

1. Report type, CPA firm, period start and end, and the date you received it.
2. The form of opinion: clean, or the modification and what it covers.
3. Whether your product, region and contracted categories sit inside the boundary.
4. Each deviation relevant to your use, with the vendor's answer.
5. The CUECs your team owns, each with a named person.
6. Follow-ups: provider reports requested, bridge letter requested, date the next report is due.

Sources: AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy; AICPA AT-C section 205 (examination engagements); AICPA DC section 200, 2018 Description Criteria for a Description of a Service Organization's System in a SOC 2 Report; AICPA TSP section 100, Trust Services Criteria.

• Inside a SOC 2 report, section by sectionWho writes each section, and what each one is for.
• A scorecard for a vendor's SOC 2 reportTen checks that tell a useful report from a thin one.
• The management assertionWhat leadership is signing, and what backs it.