What is an attestation report?

What is inside a SOC 2 report

A SOC 2 report has four main parts. It is a restricted-use document, so it is normally shared with customers and prospects under a non-disclosure agreement. A SOC 3 report is the shorter general-use version, without the detailed tests.

• Auditor’s opinion. The service auditor’s conclusion, which is usually unqualified (clean) or qualified.
• Management’s assertion. Management’s written statement that the system description is fair and the controls meet the criteria.
• System description. The services, infrastructure, people, data and boundaries in scope, and the trust service criteria covered.
• Tests and results. In a Type II report, each control, how the auditor tested it, and any exceptions found.

Attestation and certification

In an attestation, management makes claims about its system and the auditor gives an opinion on whether those claims are fairly stated. The reader then decides whether the detail meets their needs. An ISO certificate works differently: a certification body states that a management system conforms to a standard, for a defined scope, for three years with yearly surveillance audits.

Outside the US, assurance reports of the same kind are often issued under ISAE 3000 or ISAE 3402, the international standards for assurance engagements.

How to read one you receive

Check the period first. Many buyers expect a report that ended within the last twelve months, and a bridge letter from the vendor’s management can cover the time since. Check that the scope includes the service you are buying.

Then read the exceptions and management’s responses, and the complementary user entity controls: the controls the vendor expects you to run on your side. Finally, look for subservice organisations, such as a cloud provider, that the report carves out. For those you need the subservice organisation’s own report.

Related terms

SOC 2 Type I

A SOC 2 report on whether controls are suitably designed and in place on a single date. Often the first report a company obtains.

SOC 2 Type II

A SOC 2 report on whether controls operated effectively over an observation period. The report most enterprise buyers eventually ask for.

Trust Service Criteria

The five categories a SOC 2 report can cover: Security, which is always included, and optionally Availability, Confidentiality, Processing Integrity and Privacy.

Exception (audit)

An instance where a control did not operate as described during the audit period. A SOC 2 report lists exceptions, and readers judge how much they matter.

Certification body

An organisation accredited by a national accreditation body, such as UKAS or ANAB, to audit and certify management systems against ISO standards. Only a certification body can issue an ISO 27001 or ISO 42001 certificate.