Free resource
SOC 2 report example: an annotated sample
A section-by-section, annotated sample of a SOC 2 Type 2 report — with notes on the opinion, exceptions, CUECs, and subservice organizations that tell you exactly what to look for. Read it below, or download the annotated sample.
Illustrative example only. This is a fictional, annotated sample (Northwind Systems, Inc. is not a real company) built to teach you how to read a SOC 2 report. It is not a real audit report or a substitute for one — your report is issued by a licensed CPA firm. For the conceptual version, see what a SOC 2 report looks like; to vet a vendor's report, see how to review a vendor's SOC 2 report.
Section I: Independent Service Auditor's Report (the opinion)
The auditor's formal opinion on whether your controls were suitably designed and operated effectively over the period. This is the part buyers read first.
We have examined Northwind Systems, Inc.'s description of its Platform system throughout the period January 1, 2026 to June 30, 2026 (the "Report Period"), and the suitability of the design and operating effectiveness of controls to meet the criteria for the Security and Availability categories set forth in the Trust Services Criteria. In our opinion, in all material respects, the controls were suitably designed and operated effectively throughout the Report Period.
Look for the word "effectively" and the phrase "in all material respects" with no qualifying language — that's an unqualified (clean) opinion. A "qualified" opinion, or phrases like "except for," means the auditor found controls that did not operate effectively; read exactly which. Confirm the report period is recent and its length (a Type 2 covers a window, here six months). Confirm the categories examined (Security is always in; Availability, Confidentiality, Processing Integrity, and Privacy are opt-in).
Section II: Management's Assertion
A statement, signed by your management, asserting that the system description is accurate and the controls were suitably designed and operating effectively. It's your claim; Section I is the auditor's independent opinion on that claim.
We, the management of Northwind Systems, Inc., assert that the accompanying description fairly presents the Platform system that was designed and implemented throughout the period January 1, 2026 to June 30, 2026, and that the controls stated in the description were suitably designed and operated effectively to meet the applicable Trust Services Criteria.
This should mirror the scope, system, and period in the auditor's report. A mismatch between the assertion and the opinion is a red flag. It is management's responsibility to make this claim; the auditor's job is to independently test it.
Section III: Description of the System
The longest section. It describes the service being audited, its infrastructure, the people, data flows, the control environment, subservice organizations, and the Complementary User Entity Controls (CUECs) you are expected to run.
The Northwind Systems, Inc. Platform provides cloud-based workflow software hosted on Amazon Web Services (AWS). Northwind Systems, Inc. uses AWS as a subservice organization and applies the carve-out method; controls at AWS are not included in the scope of this report. Complementary User Entity Controls: user entities are responsible for (1) provisioning and deprovisioning their own users, (2) reviewing their access reports periodically, and (3) enforcing password and MFA settings available in the Platform.
Two things buyers must read here. First, subservice organizations: if the report uses the "carve-out" method (as above), the provider's controls (e.g. AWS) are NOT tested in this report and you should review their SOC 2 separately; the "inclusive" method covers them. Second, the CUECs: these are controls the report assumes YOU operate. If you don't run them, the clean opinion does not cover that gap — the responsibility is yours. Confirm the described system is the product you actually use.
Section IV: Trust Services Criteria, Controls, Tests, and Results (the matrix)
The evidence heart of the report: a table mapping each applicable criterion to the control(s) that address it, the test the auditor performed, and the result. This is where exceptions appear.
CC6.1 — Logical access controls restrict access to authorized users. Control: Access requires a unique account and MFA; access is granted only with resource-owner approval. Test: Inspected the user listing and a sample of 25 access grants for approval and MFA enrollment. Result: No exceptions noted. | CC6.2 — Access is removed on termination. Control: Access is revoked within 5 business days of termination. Test: For a sample of 15 terminations, inspected the date access was removed. Result: Exception — in 2 of 15 samples, access was removed after 5 business days (7 and 9 days). Management response: the offboarding workflow was automated in April 2026 to enforce the SLA.
Read the "Result" column. "No exceptions noted" is what you want. An "Exception" is a control that didn't operate as designed in the sample — a few minor, remediated exceptions are normal and don't necessarily mean a qualified opinion. Assess whether any exception touches a control that matters to your data (here, delayed offboarding). Check the sample sizes and that the tests actually exercise the control, not just its existence. A management response showing remediation is a good sign.
Section V: Other Information (optional)
An optional section for information the auditor did not test — for example management's future plans, responses to exceptions, or a business-continuity narrative. It carries no assurance.
Northwind Systems, Inc. plans to pursue the Confidentiality category in its next examination and has begun a SOC 2 + ISO 27001 combined readiness project.
Useful context, but remember the auditor did not test anything in this section — treat it as management's unverified statements, not assurance.
Frequently asked questions
Is this a real SOC 2 report?
No. It's an illustrative, annotated sample using a fictional company (Northwind Systems, Inc.) to show what each section of a real SOC 2 Type 2 report contains and how to read it. Real reports are confidential and issued by a licensed CPA firm; companies share theirs under NDA.
What are the sections of a SOC 2 report?
A SOC 2 report has four standard sections plus an optional fifth: (I) the independent auditor's report/opinion, (II) management's assertion, (III) the system description, (IV) the trust services criteria, controls, tests, and results matrix, and (V) optional other information the auditor did not test.
How do I know if a SOC 2 report is 'clean'?
Read Section I. An unqualified ('clean') opinion says the controls were suitably designed and operated effectively 'in all material respects' with no qualifying language. A qualified opinion, or 'except for' phrasing, means the auditor found controls that didn't operate effectively — read which.
What should I check as a customer receiving a report?
The opinion (clean vs qualified), the report period and its recency, the scope and categories, any exceptions in the Section IV matrix, the Complementary User Entity Controls you're expected to run, and whether subservice organizations are carved out (meaning you review their SOC 2 too).
Ready for your own report? Get matched with three auditors.
Tell us your stage, framework, and timeline once. We match you with three firms that fit — one short call, not five sales pitches.
Free for buyers · No spam · Independent of every firm listed