What should a SOC 2 report actually show you?
- A SOC 2 Type II report is required to describe the auditor's tests of controls and their results. That section is the report. Everything else is framing.
- 'Inquired of management and inspected evidence. No exceptions noted,' repeated eighty times, is technically a tests-and-results section. It tells you nothing about what was examined or how hard anyone looked.
- Real disclosure reads differently: the population, the sample, the procedure, the result. Specific enough that you could check it.
- Exceptions are not the embarrassing part of a report. They are the proof that testing happened. A first audit with zero findings anywhere should make you more curious, not less.
- The next reader of your report may be software doing vendor review. Boilerplate gives a human reviewer little and gives a machine nothing it can verify.
Skip to section 4
Almost nobody reads a SOC 2 report in order, and the people who know what they are doing do not start at page one.
A report has four main parts. The auditor's opinion, one page of formal conclusion. Management's assertion, the company stating its own claims. The system description, the company describing what it runs and the controls it says it has. And then the section that justifies the whole document's existence: the description of the auditor's tests of controls and the results of those tests. In a Type II examination, the kind that covers a period of months rather than a moment, the standard requires that section to be there.
The opinion tells you what the auditor concluded. Section 4 is the only place that shows what they did to earn it. When a security team evaluates your vendor's report, or a customer evaluates yours, that section is where the truth lives.
Two reports, same opinion
Both of these are real patterns, and both can sit under an identical clean opinion.
| Report A | Report B | |
|---|---|---|
| Access removal | "Inquired of management and inspected evidence of terminated user access removal. No exceptions noted." | "Obtained the full population of 14 terminations during the period from the HR system. Selected all 14, traced each to the identity provider's deactivation log. 13 removed within the 24 hours required by policy; 1 removed after 9 days. Inspected authentication logs for the gap: no activity. Management remediated and added an automated deprovisioning check." |
| What you learned | Something was inspected, once, by someone. | The population, the coverage, the standard applied, the exception found, what it meant, and what changed. |
Report A's sentence is not false. It is unfalsifiable, which is worse. You cannot tell whether it describes three days of fieldwork or three minutes of template editing. Report B you could almost re-perform yourself.
When the AICPA's journal warned about examination mills, the tell it cited was uniformity: reports that read exactly the same with a different logo on the cover. Boilerplate in section 4 is how that uniformity looks up close.
Why the blur happens
Nothing in the standards rewards vagueness. The pressure comes from economics and fear.
Economics first: template language scales, and specificity costs examiner hours. A firm producing reports in volume on evidence a platform collected writes section 4 once and reuses it, because describing real procedures would require having performed them.
Fear second: companies worry that a disclosed exception reads as failure, so they quietly prefer auditors who find little and say less. This is exactly backwards, and sophisticated buyers know it. An exception, disclosed with its context and the response to it, is evidence that someone actually looked, and that the company fixes what gets found. First-time audits find things. That is what they are for. A pristine first report built on vague procedures is not a clean bill of health. It is an untested claim wearing one.
What good disclosure reads like
You do not need to be an auditor to grade a section 4. Look for four things in the test descriptions.
The population. What was the full set: all terminations, all changes, all incidents? If the report never says what the whole population was, coverage is unknowable.
The selection. How many were examined and how were they picked? "Selected a sample of 25 of 312 changes" is a claim you can weigh. "Inspected evidence" is not.
The procedure. What did the examiner actually do: trace, reperform, observe, inspect the raw record? Verbs carry the information. "Inquired" alone, everywhere, means the auditor mostly asked.
The result, including the ugly part. Deviations, their scope, and what management did. A report that discloses its exceptions is showing you the machinery works.
There is one more reader to write for. Vendor reviews are increasingly done by software, and soon by AI agents acting for the buyer. A specific section 4 gives that reader claims it can check. Boilerplate gives it nothing, and nothing is what a cautious machine will conclude. Transparency is about to stop being a virtue and start being a filter.
The question to carry with you
Whether you are buying an audit or reading a vendor's, the question is the same: can I tell, from this document, what was actually examined and what was found?
If the answer is yes, someone did the work and let the work show. If the answer is no, you are holding an opinion you cannot verify, and you are being asked to make up the difference with trust. The standard already requires the tests and results to be described. All you are asking for is a description that describes.
Frequently asked questions
What are the sections of a SOC 2 report?
What does 'no exceptions noted' mean in a SOC 2 report?
Are exceptions in a SOC 2 report bad?
Is the tests-and-results section required in a SOC 2 Type II?
How can I judge the quality of a SOC 2 report I received from a vendor?
Keep reading
Can your auditor just rely on the platform's evidence?
Some audits test nothing but what the platform hands over. The standards ask for more, and peer reviewers are now looking.
Can a compliance platform's AI do your SOC 2?
Compliance platforms are adding AI assistants to their dashboards. The agent already in your terminal is better placed to do the work.
How much of your SOC 2 checklist is actually required?
A big slice of the checklist platforms hand out is suggestion, not requirement. What the criteria actually demand.
Should your auditor's methodology be a secret?
The criteria and the standards are public. What your auditor actually does should not be the secret part.
Sources
- A SOC 2 Type II examination under AT-C section 205 results in a report that includes the service auditor's description of tests of controls and the results thereof.
- SOC 2 reports are examination reports issued under the AICPA's SOC for Service Organizations framework.
- The AICPA's journal warned that fast-and-easy SOC examinations produce template reports that read exactly the same with a different client logo.
- The AICPA publishes common peer review deficiencies from SOC 1 and SOC 2 engagements, including deficiencies in testing and documentation.