SOC 2 Report: What It Contains, How to Read It and Examples

Most organizations that request a SOC 2 report have never actually read one. They know they need it. They know their procurement team requires it. But when the report arrives — typically a 50 to 150-page PDF — they are not sure what they are looking at, where to start, or what the document is actually telling them.

A SOC 2 report is not a certificate and it is not a scorecard. It is a formal attestation document issued by a licensed CPA firm under AICPA standards, structured into four distinct sections, each serving a specific purpose. Understanding those sections — and knowing where to look for what matters — transforms the SOC 2 report from an opaque compliance artefact into a genuinely informative document about a vendor’s security posture.

This guide from CertPro CPA LLC explains exactly what a SOC 2 report contains, how each section works, how to read the auditor’s opinion, and how to assess exceptions — whether you are a service organization preparing to receive one or a buyer learning to evaluate them.

Tl; DR:

Concern: With SOC 2 attestation becoming a standard vendor qualification requirement, service organizations and their customers alike struggle to understand what a SOC 2 report actually contains — and how to read one meaningfully rather than treating it as a pass/fail certificate.
Overview: A SOC 2 report is a structured attestation document issued by a licensed CPA firm under AICPA standards, containing the auditor’s opinion, management’s assertion, a system description, and — for Type 2 — a detailed account of every control tested and every exception found.
Solution: Service organizations and buyers should understand the four sections of a SOC 2 report, what each section contains, how to interpret the auditor’s opinion, and how to assess exceptions — so that a SOC 2 report becomes a genuinely useful instrument of trust rather than a document that sits unread in a vendor portal.

SOC 2 Report: What It Contains, How to Read It and Examples

A SOC 2 report is the formal output of a SOC 2 examination conducted by a licensed CPA firm. It is issued under AICPA AT-C Section 205 and contains the auditor’s professional opinion on whether a service organization’s controls met the applicable Trust Services Criteria — along with the evidence, system description, and test results that support that opinion.

What Type of Document is a SOC 2 Report?

A SOC 2 report is an attestation report — not a certificate, not a compliance badge, and not a software-generated summary. It is a professionally structured document bearing the opinion of a licensed CPA firm that has independently examined a service organization’s controls.

The AICPA’s SOC Suite of Services defines two types of SOC 2 report:

SOC 2 Type 1 report — issued after an examination of control design at a single point in time. It answers whether controls were suitably designed as of the report date.

SOC 2 Type 2 report — issued after an examination of both control design and operating effectiveness across an observation period — typically six to twelve months. It answers whether controls were suitably designed and actually operated effectively throughout the period. For a full breakdown of the difference, see SOC 2 Type 2.

Enterprise buyers require Type 2. The remainder of this guide focuses on the Type 2 report — the standard format buyers and auditors work with.

How Long is a SOC 2 Report?

A SOC 2 Type 2 report is typically between 50 and 150 pages, depending on the complexity of the service organization’s system, the number of Trust Services Criteria in scope, and the number of controls tested. Organizations with larger infrastructure footprints, more complex data flows, or multiple applicable criteria will produce longer reports.

The length can feel intimidating to first-time readers. In practice, most buyers focus on three things: the auditor’s opinion (Section 1), the observation period dates, and the exceptions table in Section 4. Understanding the structure makes navigation straightforward.

The Four Sections of a SOC 2 Report

Every SOC 2 report issued by CertPro CPA LLC follows the standardized four-section structure defined by the AICPA.

Section 1 — Independent Service Auditor’s Report

This is the most important section. It contains CertPro CPA LLC’s formal professional opinion — the conclusion that every buyer reads first and that determines the report’s value as an assurance instrument.

What Section 1 contains:

Addressee — the report is addressed to the service organization’s management and, in some cases, to user entities — the customers who rely on the service organization’s services.

Scope paragraph — describes what was examined: the system, the applicable Trust Services Criteria, and the observation period.

Management’s responsibility — a statement that management is responsible for the design, implementation, and operation of the controls described in the system description.

Auditor’s responsibility — a statement that CertPro CPA LLC’s responsibility is to express an opinion based on the examination conducted under AICPA AT-C Section 205.

The opinion — the formal conclusion. There are three possible opinion types:

Unqualified opinion — the controls were suitably designed and operated effectively throughout the observation period in relation to the applicable Trust Services Criteria. This is the outcome buyers expect from a well-prepared organization.

Qualified opinion — the controls met the criteria except in specific areas where material deviations were found. The qualification describes exactly which criteria or controls were affected.

Adverse opinion — the controls did not meet the applicable criteria. An adverse opinion is rare in engagements where adequate readiness assessment work was completed beforehand.

How to read the opinion: Look for the words “in our opinion” followed by either “the description fairly presents” and “the controls were suitably designed and operating effectively” (unqualified) or qualifying language that identifies specific deviations (qualified or adverse). The opinion paragraph is the single most important sentence in the report.

Section 2 — Management’s Assertion

Section 2 contains a formal written statement from the service organization’s management — signed by an authorized executive — asserting that:

The system description fairly presents the system as designed and implemented throughout the observation period.

The controls stated in the description were suitably designed to provide reasonable assurance that the applicable Trust Services Criteria would be achieved.

For Type 2: the controls operated effectively throughout the observation period.

Management’s assertion is the responsible party’s statement of accountability. It places legal and professional responsibility on the service organization’s management for the accuracy of the system description and the representation of controls. Buyers read this section to understand the scope of management’s claims — and to identify any qualifications or limitations that management has placed on their assertion.

What to look for: Any language that limits or qualifies the assertion — for example, assertions that cover only part of the observation period, or that exclude specific systems or services from scope. These qualifications narrow the assurance the report provides.

Section 3 — System Description

Section 3 is the longest narrative section of the report. It is written by the service organization’s management and describes the system that was examined — in sufficient detail for buyers to understand what the service organization does, how it does it, and what controls govern the process.

A complete system description covers:

Services provided — a description of the services the service organization provides to its customers, including the nature of the data processed, stored, or transmitted and the commitments made to customers.

System components — the five components that together constitute the system in scope: Infrastructure (physical and virtual hardware, networks, and facilities), Software (applications, operating systems, and databases), People (personnel involved in delivering the service), Processes (manual and automated procedures), and Data (types of data processed, stored, and transmitted).

System boundaries — a clear definition of where the system in scope begins and ends, including what is excluded and why.

Principal service commitments and system requirements — the security, availability, and other commitments the service organization has made to its customers, typically documented in service level agreements, contracts, and privacy notices.

Controls — a description of the controls management has implemented to meet the applicable Trust Services Criteria and Common Criteria, organized by control category.

Complementary user entity controls (CUECs) — controls that customers of the service organization must implement for the service organization’s controls to be effective. CUECs are important for buyers — they define what the buyer is responsible for in the shared security model.

Complementary subservice organization controls — where the service organization relies on subservice providers (cloud hosting, data centers, payment processors), this section describes what controls those subservice organizations are assumed to have in place.

What to look for: Buyers should read the system description to understand exactly what is in scope, what is excluded, what the CUECs are, and whether the described system matches their understanding of how the service organization’s platform operates.

Section 4 — Description of Tests and Results

Section 4 is the operational core of the Type 2 report. It is where CertPro CPA LLC documents every control tested, the testing procedure applied, and the result observed. For most reports, this section spans the majority of the document’s total page count.

Structure of Section 4: For each control in scope, the section contains three columns:

What “No exceptions noted” means: The control operated as described throughout the observation period. CertPro CPA LLC tested it and found no instances where it failed to function as designed.

What an exception means: CertPro CPA LLC found one or more instances during the observation period where the control did not operate as described. The exception is documented with sufficient detail for readers to understand its nature, frequency, and potential impact. See Common SOC 2 Audit Exceptions for a full breakdown of exception types and how to assess them.

How to read Section 4 efficiently: Experienced buyers scan Section 4 for exceptions rather than reading every line. The most efficient approach is to identify all rows where the Results column contains text beyond “No exceptions noted” — and then evaluate each exception for materiality, frequency, and whether management has provided remediation evidence.

How to Assess Exceptions in a SOC 2 Report

Exceptions in a SOC 2 report are not automatic deal-breakers. They are documented findings that require assessment — and assessing them properly is what separates sophisticated buyers from those who treat SOC 2 as a binary pass/fail credential.

Questions to ask when evaluating an exception:

What control failed? The significance of an exception depends entirely on which control was involved. An exception in access review is more significant than an exception in a low-risk administrative procedure.

How often did it fail? An exception that occurred once in twelve months is materially different from one that occurred repeatedly. The exception description should indicate frequency — for example, “In 2 of 24 instances tested, the control was not performed within the required timeframe.”

What is the impact? Did the exception result in any actual security event? Was any data exposed, any unauthorized access granted, or any service disruption caused? An exception with no downstream impact is less significant than one that resulted in a real security event.

Has it been remediated? Many exceptions are accompanied by management’s response describing corrective action taken. A well-documented remediation demonstrates that the organization identified the failure, understood its cause, and fixed it — which is itself evidence of a functioning control environment.

Is it isolated or systemic? A single exception in one control area is an isolated finding. Multiple exceptions across related controls suggest a systemic weakness — for example, a general failure of the access management programme rather than an isolated incident.

Who Can See a SOC 2 Report?

SOC 2 reports are confidential documents. They are not published publicly — unlike SOC 3 reports, which are designed for public distribution. A SOC 2 report is shared under a non-disclosure agreement with:

Current and prospective customers who have a legitimate business need to assess the service organization’s security controls.

Regulators and government bodies that require it as part of a compliance review.

The service organization’s own management and board.

Service organizations should maintain a formal report distribution process — tracking who has received the report, under what NDA terms, and for what purpose. CertPro CPA LLC advises all clients on appropriate report distribution practices as part of the engagement.

Organizations that want a publicly shareable credential use a SOC 3 report — a sanitized summary of the SOC 2 findings, suitable for posting on a website or including in marketing materials. See SOC 1 vs SOC 2 vs SOC 3 for a full comparison.

How Long is a SOC 2 Report Valid?

A SOC 2 Type 2 report covers a defined observation period and is generally treated as current for twelve months after the observation period end date. After that point, buyers begin to question whether the controls documented in the report are still in place and operating effectively.

Annual re-examination is the standard practice — each year, CertPro CPA LLC conducts a fresh examination covering a new observation period and issues a new report. For full details on report validity and what happens when a report lapses, see SOC 2 Report Validity.

Obtain Your SOC 2 Report with CertPro CPA LLC

CertPro CPA LLC is a licensed CPA firm that issues SOC 2 attestation reports under AICPA AT-C Section 205. Every report we issue follows the standardized four-section structure, is signed by a licensed CPA, and is subject to peer review — producing a document that enterprise buyers, regulated-sector customers, and institutional partners accept without question.

Explore the full SOC 2 hub for detailed guidance on every aspect of the SOC 2 process.

Ready to begin? Contact CertPro CPA LLC to scope your SOC 2 engagement.

FAQ