Interactive
Take a sample SOC 2 report apart, one marker at a time.
The report below belongs to an invented company and is cut down to its essentials. Numbered markers sit on the lines that matter. Open one to see what the line is doing there and the question worth putting to a real vendor.
Back to SOC 2 services01 · Using it
Before you open the sample
Tap or click a number to open its note.
- Part 1: the CPA firm's report
- Part 2: management's assertion
- Part 3: the system description
- Part 4: tests and results
- Part 5: other information
The parts follow the order the AICPA's SOC 2 guide sets out for a Type 2 report. The company, its wording and its results are ours, written to teach reading. Real reports run far longer, mostly because the testing part lists every control; the sample keeps two so each marker stays easy to follow.
02 · The report
Larkspur Cloud's report, annotated
Five parts, 18 markers, open them in any order.
SOC 2 Type 2 report · illustrationLarkspur Cloud, Inc. (fictional)
Section 1 · Independent service auditor's report
- Scope: the Larkspur Platform system, against the Security and Availability criteria.
- Period: throughout January 1 to December 31.
- Opinion: Larkspur's account of the system is fair, and its controls worked throughout the period, in all material respects…
- Inherent limitations: controls may not prevent or detect every error or fraud.
- Restricted use: intended solely for Larkspur, its user entities and prospective users.
Section 2 · Management's assertion
- We have prepared the accompanying description in accordance with DC 200…
- Signed: Chief Executive Officer, Larkspur Cloud, Inc.
Section 3 · Description of the system
- Service commitments: the platform is up at least 99.9% of each month; customer data is encrypted at rest and in transit.
- System components: the people, procedures and data behind the service, plus its software and hosting.
- Subservice organization: cloud hosting provider, carved out.
- Complementary user entity controls: customers manage their own user access.
- System incidents: none meeting the disclosure threshold during the period.
Section 4 · Criteria, controls, tests and results
- CC6.3 · Quarterly access reviews are performed and approved.
- Test: inspected the reviews for a sample of quarters and the resulting tickets.
- Result: no exceptions noted.
- CC8.1 · Changes are approved before deployment.
- Result: 1 of 25 sampled changes deployed without recorded approval.
Section 5 · Other information (unaudited)
- Management's response: approval is now enforced in the deployment pipeline.
03 · Three passes
Three passes that work on any real report
Practise on the sample; use the passes at work.
Pass 1
Is it the right report?
- Markers 1 and 2: the system, the categories, the period
- Marker 3: any paragraph that modifies the opinion
- Marker 5: whether you are an intended reader
Pass 2
What went wrong?
- Markers 13 to 17: the control, the test method, the result
- Marker 18: the company's unaudited reply
- Marker 12: incidents disclosed for the period
Pass 3
What is left to you?
- Marker 10: the carved-out host and its own report
- Marker 11: controls you are assumed to run
- Marker 8: promises to set beside your contract
Pass 1 can end the review early: if your product sits outside the system named at marker 1, the rest of the report is about something else.
04 · Markers that matter
Five markers a buyer should never skip
Short on time? Read these first.
| Marker | Why it matters | What to do with it |
|---|---|---|
| 1 · Scope line | Everything after it applies to that system alone | Confirm your product is named |
| 3 · Opinion | A modifying paragraph changes how far you can rely on the rest | Record the form of opinion in your vendor file |
| 10 · Carve-out | The hosting layer was not tested in this report | Request the host's own report if that layer matters to you |
| 11 · CUECs | The assurance assumes your team does these | Give each one a named owner on your side |
| 17 · Deviation | Shows where a control slipped during the period | Weigh it against your use, then read marker 18 |
Sources: AICPA guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (report structure); AICPA DC section 200, 2018 Description Criteria (system components, commitments, incidents, CUECs); AICPA AT-C section 205 (examination engagements). The sample company and every figure in it are fictional.
Questions about the sample
Who wrote the sample, and does the company exist?
Auditify wrote it; the company is invented.
Larkspur Cloud is fictional. We built the sample from the public layout of a SOC 2 Type 2 report to teach reading, not to imitate any real firm's report or any real auditor's wording.
Why is the opinion clean when a change went out without approval?
One failed item in a sample rarely leaves a criterion unmet.
The firm weighs a deviation against the sample size, its cause and any other control covering the same risk. One unapproved change out of 25 sampled, explained and fixed, usually stays in the test results without touching the opinion.
Can we use the sample to check a vendor's real report?
Use its markers as a checklist, not as a template.
Real reports differ in wording and length from firm to firm. The 18 markers point at elements every Type 2 report should contain, so you can look for each one in the real document and note any that are missing.
A report readers can follow starts with your description.
A SOC 2 readiness assessment shapes the system description and evidence that a CPA firm will later examine.