The report
Inside a SOC 2 report: who wrote what, and why.
A SOC 2 report reads like one document but has two authors. The CPA firm writes the opinion and the test results. Management writes the assertion and the system description. Knowing which voice you are reading tells you how much assurance a sentence carries.
Back to SOC 2 services02 · Section map
The section map
Section numbers vary by firm. The parts do not.
| Part | Author | Purpose | Covered by the opinion? |
|---|---|---|---|
| Independent service auditor's report | CPA firm | States scope, responsibilities, limits and the opinion | It is the opinion |
| Management's assertion | Management | Management's written claims about the description and controls | The opinion addresses the same matters |
| System description | Management | Describes the system, boundary, controls, CUECs and subservice organizations | Yes |
| Tests of controls and results (Type 2) | CPA firm, on management's controls | Shows what was tested, how, and what was found | Supports the opinion |
| Other information | Management | Responses to exceptions, future plans, extra context | No |
Most reports number these parts Sections 1 to 5 in roughly this order, but the layout is a convention, not a rule. Find each part by its heading, not its number.
03 · The opinion letter
The parts of the CPA firm's report
A short letter with a fixed set of building blocks.
- Scope
- The system, the categories examined, and the date (Type 1) or period (Type 2).
- Subservice organizations and complementary controls
- Whether vendors were carved out or included, and that some criteria depend on CUECs or CSOCs.
- Responsibilities
- What management is responsible for, and what the auditor is responsible for.
- Inherent limitations
- Why controls can fail, and why conclusions don't project into the future.
- Tests of controls (Type 2)
- A pointer to the section that describes the tests and results.
- Opinion
- The conclusion, plus a basis paragraph if it is modified.
- Restricted use
- Who the report is intended for.
- Signature and date
- The firm's name, location and the report date.
04 · Management's parts
Management's two sections
The assertion makes the claims; the description gives them substance.
The assertion is a short statement, signed by management, that vouches for two things: the write-up of the system is a fair picture, and the controls were well designed and, in a Type 2, ran effectively. The description is the long part: services, components, boundaries, commitments, controls, CUECs, subservice organizations and significant changes. Each has its own guide on this site: the management assertion and writing the system description.
Why the authorship matters to a reader
A sentence in the description is management's claim, examined against the description criteria. A sentence in Section 5 is management's claim that nobody examined. Same company, very different weight.
05 · Tests and results
The tests section: a shared table
Management's controls on the left, the auditor's work on the right.
- Criterion
- The Trust Services Criterion the control addresses, such as CC6.2.
- Control
- Management's control, in management's words from the description.
- Test performed
- The auditor's procedure: inquiry, inspection, observation or re-performance, and of what.
- Result
- “No exceptions noted” or a description of the deviations found.
A Type 1 report has no tests of operating effectiveness, so this part is absent or much shorter. For how exceptions are judged, see our guide on opinions and exceptions.
06 · Other information
The unaudited part at the back
Useful context. Zero assurance.
- Management's responses to exceptions, with remediation plans.
- Descriptions of controls or services outside the examined scope.
- Plans for the coming year.
The auditor reads this part for anything that contradicts the examined sections, but gives no opinion on it. Treat promises here as promises, not findings.
Sources: AICPA attestation standards AT-C section 105 and AT-C section 205; DC section 200, 2018 Description Criteria for a Description of a Service Organization's System in a SOC 2 Report (with 2022 revisions); AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization.
Questions about how a SOC 2 report is built
Why does management's assertion repeat what the opinion says?
Because the examination is built around management's claims.
Under the attestation standards, the auditor reports on a subject matter, or an assertion about it, against criteria. The assertion sets out management's claims; the opinion states whether the auditor agrees. The overlap is by design.
Who wrote the control descriptions in the tests section?
Management. The firm wrote the tests and results.
The controls come from management's description. The test performed and the result columns are the auditor's. If a control reads vaguely, that is management's wording.
Is anything in the report written by a third party other than the firm?
Usually not, though vendor reports may be referred to.
With the carve-out method, the report refers to a subservice organization without including its controls. With the inclusive method, that vendor's controls are described and tested, and the vendor provides its own assertion.
Why do some reports have more than five sections?
Firms add appendices and change the numbering.
Some split the description into several sections, or add appendices for criteria mappings or definitions. The underlying parts remain the same; read the headings.
Write your sections with care.
A SOC 2 readiness assessment helps management draft the parts it owns: the assertion and the system description.