How to Review a SOC Report for Third-Party Risk

Q: How should an organization review a SOC report?

An organization should confirm the report scope, evaluate the auditor’s opinion, review CUECs, assess exceptions, and follow up on gaps or concerns.

Executive Contacts

Erika Walker

Mike Shamblin

Andrew Sizemore

Additional Contributors

Emma Alexander

In our previous article, How to Choose the Right SOC Report to Build Trust and Support Compliance, we explored what System and Organization Controls (SOC) reports are and how they help organizations build trust in the services provided by third-party service organizations (external vendors).

What is a SOC Report?

SOC reports are independent examination reports issued under the Statement on Standards for Attestation Engagements (SSAE) No. 16/18 and developed by the American Institute of Certified Public Accountants (AICPA).

What is the Purpose of a SOC Report?

The purpose of a SOC report is to help service organizations provide insight into how their internal controls are designed and, where applicable, whether those controls are operating effectively over a defined period.

Organizations rely on third-party service providers to support critical functions such as payroll processing, general ledger systems, electronic medical records, and IT hosting services. While outsourcing can provide operational efficiencies and access to specialized expertise, it also introduces additional risk, particularly when these services impact financial reporting, data security, or regulatory compliance.

SOC reports help mitigate this risk by providing independent assurance over the third-party service organization’s control environment. When properly reviewed, these reports can help organizations evaluate whether a vendor’s controls are appropriately designed and functioning as intended.

You Received Your Vendor’s SOC Report. Now What?

Many organizations receive these reports as part of their vendor’s oversight processes but are unsure how to evaluate them or use them effectively. Simply obtaining the vendor’s SOC report is only the first step. Without a structured review process, organizations risk overlooking key issues or failing to gain meaningful assurance from the report.

A Step-by-Step Approach to Reviewing Vendor SOC Reports

This article provides a practical, step-by-step approach to reviewing a SOC report and using it as a valuable tool to help manage third-party risk management (TPRM), vendor oversight, and internal control evaluation.

Start Here: Does the SOC Report Cover the Services Your Organization Uses?

Before evaluating any details within the report, the most important first step is to confirm that the SOC report applies to the specific service or system your organization uses.

This assessment begins with the system description section, which outlines the services provided, system boundaries, and scope of the engagement. Organizations should carefully review this section to ensure it accurately aligns with the nature of the services received from the service organization.

In practice, it is not uncommon for service organizations (vendors) to provide SOC reports that cover

- Multiple product offerings
- A subset of services not used by your organization
- A broader system environment that may not align with how your organization interacts with the service

If the services, system, or module your organization uses are not included in the report, you should pause the review and request the appropriate SOC report from the vendor. Proceeding with the wrong report can result in reliance on controls that are not applicable.

Does the Report Meet Your Audit and Risk Management Needs?

Once relevance of the report is confirmed, the next step is to evaluate whether the report meets your organization’s needs from both a timing and credibility perspective.

Review the Reporting Period

Organizations should first confirm that the SOC report covers the period relevant to their financial reporting or audit requirements. SOC 2 Type II reports, for example, typically cover 6-12 months, while Type I reports only reflect controls at a point in time (e.g., as of July 30).

If there is a timing gap between the end date of the period covered in the report and your organization’s fiscal year-end, a bridge letter may be necessary. A bridge letter is a representation provided by the vendor indicating whether any significant changes to controls occurred during the gap period.

Confirm Credibility

The reliability of a SOC report is influenced by the credibility and experience of the issuing firm. Organizations should confirm that

- The report was issued by an independent certified public accounting (CPA) firm
- The firm is in good standing with the AICPA and demonstrates appropriate quality through peer review results and adherence to professional standards

While many reputable firms perform SOC audits, additional consideration may be needed if the firm does not maintain a strong focus on attestation services or has limited experience performing SOC engagements.

When there is uncertainty, organizations should consult with their financial statement auditors to assess whether the SOC report is appropriate for reliance.

What Does the Auditor’s Opinion Say?

The Independent Service Auditor’s Report is one of the most critical sections within the SOC report, as it provides the auditor’s opinion on the control environment.

An unqualified (clean) opinion indicates that the controls are appropriately designed and, for a Type II report, operated effectively throughout the period.

Organizations should also watch for modifying language, such as

- “Except for”
- “Subject to”

These phrases indicate a qualified opinion, meaning that one or more significant control deficiencies were identified. While a qualified opinion does not automatically preclude reliance, it does warrant further evaluation to determine whether the identified exceptions impact the organization.

Organizations may choose to reach out to the service provider to gain clarity around the nature and scope of the qualified opinion. Alternatively, engaging with your financial statement auditor can help determine appropriate next steps and assess whether the noted exceptions affect your reliance strategy. Obtaining this additional insight may help enable informed decision-making that aligns with your organization’s risk tolerance and audit requirements.

Understand Your Responsibilities: What are Complementary User Entity Controls?

Most SOC reports assume that both the vendor and the user organization have responsibilities with regard to controls related to the services covered by the report. These user responsibilities are referred to as Complementary User Entity Controls (CUECs) and are found within the System Description section of the report.

CUECs are controls that the vendor expects your organization to perform for the system of controls to function effectively. Examples may include

- Restricting system access to authorized users
- Reviewing reports generated by the vendor
- Monitoring activity or exceptions

Failure to implement these controls may result in gaps in the intended overall control framework, even if the vendor’s controls are operating effectively.

Accordingly, organizations should

- Identify all CUECs listed in the report
- Map them to existing internal controls within their environment
- Evaluate whether they are operating consistently

This step is especially important for financial statement audits and compliance processes, where reliance on the SOC report may depend on the operation of these controls.

How Should SOC Report Testing be Reviewed?

SOC reports include detailed testing of controls, typically within Section IV, which outlines

- The underlying control objectives
- The controls in place to support the objectives
- The tests performed by the auditor
- The test results

Identify and Evaluate Exceptions

During this review, organizations should identify any exceptions that occur when a control does not operate as described.

Not all exceptions are significant; however, each should be evaluated to determine:

- Whether the exception relates to a process your organization relies on
- The frequency and severity of the deviation
- The potential impact on financial reporting or data security

This evaluation helps determine whether additional internal controls or compensating procedures are necessary.

Review Remediation Efforts

SOC reports may also include information on how the service organization addressed identified issues. Reviewing these remediation efforts provides insight into

- The organization’s responsiveness to control deficiencies
- Whether issues were resolved during the reporting period
- The overall maturity of the control environment

If issues remain unresolved, additional follow-up or monitoring may be required.

How Should SOC Reports Support Vendor Management and TPRM?

SOC reports should not be treated as a one-time review or compliance requirement. Instead, they should be integrated into an organization’s broader vendor management or third-party risk management (TPRM) framework.

Within this framework, SOC reports can be used to

- Assess the risk profile of critical vendors
- Support ongoing vendor monitoring and oversight
- Inform audit planning and risk assessments
- Demonstrate compliance with regulatory expectations

Additionally, a SOC report should prompt follow-up with the vendor when exceptions, control gaps, or other concerns are identified.

This follow-up may include

- Clarification of control failures
- Details on remediation efforts
- Timelines for resolution

For SOC 2 reports, organizations may also review disclosures related to security incidents and how they were addressed. These disclosures provide valuable insight into the provider’s ability to detect, respond to, and remediate risks.

By incorporating SOC report reviews into a structured TPRM process, organizations can ensure they are continuously monitoring risks associated with outsourced services rather than relying on periodic or reactive reviews.

How Can Your Organization Translate Insight into Action?

The ultimate goal of a SOC report review is to translate findings into meaningful action. This may include

Strengthening internal controls
Enhancing oversight of third-party providers
Implementing compensating controls where needed
Escalating issues to management or governance bodies

When used effectively, SOC reports provide actionable insights that can improve an organization’s overall control environment and reduce risk exposure.

Key Takeaways

Obtaining a SOC report is an important step in managing third-party risk, but it is only the beginning. A thoughtful, structured review process is essential to fully understand the information provided and determine how it applies to your organization.

By focusing on relevance, credibility, control performance, and user responsibilities, organizations can move beyond a “check-the-box” approach and use SOC reports as a strategic tool for strengthening risk management and building trust with stakeholders.

PYA Can Help

As part of PYA’s Audit and Assurance Services, our professionals perform SOC audits across a variety of industries and bring deep subject matter experience in third-party risk management. PYA can help organizations strengthen third-party risk management programs, perform outsourced vendor risk assessments, and advise upon internal control matters to support more effective oversight, compliance, and risk-informed decision-making.

Sources

1. https://soc2auditors.org/insights/soc-2-trust-services-criteria/
2. https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services