How to Read a Vendor's SOC 2 Type II Report

Updated October 2026. First published February 2024.

Ask a vendor how it protects your data, and you'll often get a SOC 2 Type II report. FINRA expects you to ask. Its Regulatory Notice 21-29 on vendor management asks whether your firm considers "obtaining evaluations of prospective Vendors' SSAE 18, Type II, SOC 2" reports, and whether it monitors existing vendors, "for example, by reviewing SOC 2 reports."

Getting the report is the easy part. This post is about reading it: what to check, in order, before you file it as evidence of due diligence. For the wider list of what regulators expect in vendor diligence, see our vendor due diligence page. For why FINRA has made third-party risk an exam focus, see our post on FINRA's third-party risk priority. Neither is repeated here.

First, What the Report Is

A SOC 2 report is an attestation report. An independent CPA firm examines the vendor's description of its system and its controls against the AICPA's Trust Services Criteria, and only a CPA or CPA firm can issue one (Linford & Co.). A vendor's controls are audited; nothing is certified. If a vendor calls itself "SOC 2 certified," it's using the wrong word, and it's fair to ask what else in the sales deck is loose.

A Type I report looks at whether the controls were designed properly at one point in time. A Type II report also tests whether they operated effectively over a period, usually 6, 9, or 12 months. For a vendor that will hold your data, ask for Type II.

Six Things to Check

1. The Scope

Read the system description first. Confirm it covers the service you're buying, from the locations and the platform you'll use. A report on the vendor's hosting operation tells you little about the application your staff will log into. PYA, a CPA firm, calls scope "the most important first step."

2. The Period, and the Gap After It

Note when the period ended. If it ended months before your review, ask for a bridge letter, which is the vendor's statement that no significant control changes happened since. The vendor writes and signs a bridge letter, and no auditor tests it.

3. The Opinion

An unqualified opinion means the auditor found the controls suitably designed and, in a Type II report, found that they operated effectively. Look for "except for" in the opinion paragraph. That's a qualified opinion, and it points you to the controls that failed.

4. The Exceptions

The section that describes the auditor's tests and results is the one to read most closely. Read every exception. For each one, decide whether it touches something you rely on, such as access reviews, change management, or backups, and read the vendor's response. One missed quarterly access review out of four is a different finding from no access reviews at all.

5. The Controls That Are Yours

The system description lists complementary user entity controls (CUECs): things the vendor assumes you do. Typical ones cover adding and removing your own users, periodic access reviews, and the credentials you're issued. If you don't do them, the vendor's report doesn't cover that part of the risk. Map each CUEC to an owner at your firm, and check that the owner knows.

6. The Vendors Behind the Vendor

Most SaaS vendors run on someone else's infrastructure. The report names these subservice organizations and the controls the vendor expects them to run, called complementary subservice organization controls. Check whether the auditor tested those controls or left them out of scope. If they were left out, ask for the subservice organization's own SOC report, or at least confirm that the vendor reviews it. FINRA's notice asks the same question: whether you evaluate "Vendors' controls and due diligence of Vendors' sub-contractors."

What the Report Won't Tell You

A SOC 2 report describes controls. The commitments you need from the vendor belong in the contract, and three matter most:

Breach notice. The amended Regulation S-P requires your firm to have procedures that make a service provider notify you as soon as possible, and no later than 72 hours, after it becomes aware of a breach that gave someone unauthorized access to a customer information system it maintains. Your own deadline to notify affected customers is 30 days after you become aware of the incident.
Your data at the end. Notice 21-29 points to "ownership and disposition of firm and customer data at the end of the Vendor relationship." Say in the contract how and in what format you get it back, and when the vendor deletes it.
Outages. Notice 21-29 also asks about "contingency plans for interruptions or terminations of Vendor services." Our post on the 2024 EquiLend outage covers what that plan needs.

Loffa's SOC 1 and SOC 2 Type II reports are available under NDA. Our vendor due diligence page also lists what we don't claim, including that we hold no ISO certification.