Have you seen a SOC 2 report example before? Well, now you can say that you have!
Today, we’re going to break down a SOC 2 report example, so you know what to look out for when yours arrives.
The sample report from the AICPA above contains all of the components of a Type 2 SOC 2 report but, believe it or not, it’s less wordy. I know that sounds like a sham, but they put in ellipses(…) where there should be more detail. Service organizations and service auditors may organize and present information in a variety of formats but this is a great snapshot of what to expect.
FYI, while this example report contains Trust Service Criteria (TSC) and Cloud Controls Matrix (CCM), most SOC 2 reports only contain TSC. So that’s what we will be focusing on.
Take a deep breath. It’s totally normal to feel sweaty and anxious when 30-70 pages of acronyms, tables, charts, and complicated legalese arrive in tiny font for your reading pleasure. But don’t worry––you got this!
What Is a SOC 2 Report
Systems and Organization Controls 2 (SOC 2) is an attestation that evaluates your company’s ability to securely manage the data you collect from your customers and use during business operations. A certified public accountant (CPA) that you hire performs the audit. When it’s completed you’ll receive the SOC 2 report.
When the audit is over, the report you receive feels slightly like a choose your own adventure book written in a foreign language. It’s full of technical jargon. The content is constantly referencing other passages that involve page flipping to jog your memory. But if you understand the structure, it’s a little less intimidating.
So as Maria sang angelically in The Sound Of Music—Let’s start at the very beginning, a very good place to start.
SOC 2 Section 1: Assertion of the Management
The assertion provides the reader the facts and assertions, or statements, made by the service organization’s management related to the system(s) under audit. This section is produced by your company as the service organization. It’s a summary of your product, services, structure and lightly covers your IT systems, teams and controls.
SOC 2 Section 2: Independent Service Auditor’s Report
If you’re one of those people who like to flip to the good parts in a book or read spoilers, this is the section that you’re looking for. Your auditor divulges what they did over the stated time period and explains the scope. They also spill the tea about whether you passed or failed your audit.
Kinds of opinions presented by the auditor in this section and what they mean:
- Unqualified—You pass! Gold star!
- Qualified—You fail.
- Adverse—You really fail! Your system can’t be trusted.
- Disclaimer of Opinion—Incomplete. You didn’t provide the auditor with enough information for them to form an opinion.
Page 7 of the AICPA Example Report
While this does refer to the CCM that we told you to ignore, the SOC 2 Report Example above is an unqualified opinion. The auditor didn’t report any concerns and this is what you hope to see! It would be worded in a similar manner for TSC.
But often, there’s room for improvement. Qualified or adverse opinions may look like:
- The description does not fairly present the system that was designed and implemented throughout the period.
- The controls related to the control objectives stated in the description were not suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively throughout the period [date] to [date].
- The controls tested, which were those necessary to provide reasonable assurance that the control objectives stated in the description were achieved, did not operate effectively throughout the period from [date] to [date].
[SOURCE: Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting Guide]
For a more detailed look at section two, check out our blog Understanding Your Auditor’s SOC 2 Report Opinion.
The Ultimate Survival Guide to SOC 2 Compliance
Feeling iffy about SOC 2? Download The Ultimate Survival Guide to SOC 2 Compliance and get the help you need to ace your next audit.
Download eBookSOC 2 Section 3: Description of Your System
This is one of the most comprehensive and detailed sections in the report, written by your company as the service organization. This section is an overview of the company being assessed and builds upon the items mentioned in section one. It encompasses the detail of the system(s) being reported on, boundaries, infrastructure, controls, sub-service organizations, user entity controls, and other systems information. Lists, charts, and graphics add another layer of data for readers to immerse themselves in. The risk assessment and Trust Service Criteria are also referenced and described in detail. Anything included in this section must be capable of being audited to meet the control objectives and receive a passing report.
Like section one, you may have already seen this content while you were putting information together to submit to your auditor.
SOC 2 Section 4: Applicable Trust Service Categories, Criteria, Related Controls, Tests of Controls and Results of Tests
Section four is a great deal longer than section two but just as exciting because it shows the WHY behind your auditor’s opinion. For a SOC 2 Type 2, the objective of testing is to determine the operating effectiveness of the controls you specified in section 3 throughout your examination period. Testing provides reasonable, but not absolute, assurance that the specified controls were achieved throughout the examination period.
This section includes:
- Control objectives related to the applicable trust service categories.
- Controls in place at the service organization to meet the objectives
- Auditor’s tests of the controls and test procedures
- Results of the tests performed by the auditor
The SOC 2 report example states, “The system is protected against unauthorized access (both physical and logical). The system is available for operation and use as committed or agreed.”
The statement reaffirms the auditor’s unqualified opinion from section two before breaking everything down into a detailed chart of tests and verifications completed by the auditor. The charts will vary from auditor to auditor. You’ll notice that the AICPA example report we used above is pretty simple, but that’s not always the case. For instance, in our SOC 2 report, this section is broken out into six columns, and our chart spans 23 pages.
SOC 2 Section 5: Other Information Provided by Organization Not Covered by the Service Auditor’s Report
Remember those projects you could do for extra credit in school? Section five is optional and not tested by your auditor, but it looks good if you chose to include it.
It provides additional information about your organization’s future plans for new systems or key aspects of your control environment that is not covered by section 3 but you would like to communicate to your customers. It won’t be subjected to the procedures applied in the examination. The SOC 2 report example omits section five for brevity, but it looks similar to the other sections chock-full of text, charts and tables.
How Tugboat Logic Can Help
To sell in today’s environment, more organizations are requiring third-party security attestations, like SOC 2! Proving to vendors, you’re a safe business partner matters, and Tugboat Logic is here to help.
Sometimes, the difference between passing and failing a SOC 2 audit depends entirely on who you’ve got in your corner. If you’re ever worried about preparing for or maintaining SOC 2, don’t hesitate to get in touch with us. We’re always here to help.
Alternatively, if you’re looking for an easier way to get through SOC 2 in one piece, grab a free trial of our product. We’ll set you up with the right policies, show you which controls you need to implement, help you gather evidence, and snag that unqualified report.
Everything SOC 2, All the Time
SOC 2 got you stumped? Check out our library of SOC 2 resources.
Learn More