SOC 2 Report

A SOC 2 report is an attestation report in which an independent certified public accountant examines the controls that a service organization uses to protect the systems and data it handles for customers. SOC stands for System and Organization Controls, a family of reports defined by the American Institute of Certified Public Accountants. The SOC 2 report measures controls against the institute's Trust Services Criteria.

In financial services the report is a standard part of vendor due diligence. Banks, payment companies and fintech firms ask their processors, cloud providers and software suppliers for a current report before signing a contract, and are asked for their own by partners and corporate customers. It is a voluntary assurance document, not a license or a legal requirement, although regulators expect firms to obtain evidence of this kind when they outsource.

The criteria are grouped into five categories. Security is required in every report, and the organization chooses which of the others to include according to the services it offers.

• Security. Protection of systems against unauthorized access and damage, covering matters such as access control, change management, monitoring and incident response. These are known as the common criteria.
• Availability. Whether the system is available for use as committed, including capacity, backup and recovery.
• Processing integrity. Whether processing is complete, valid, accurate, timely and authorized, a category of particular interest for payment and ledger systems.
• Confidentiality. Protection of information designated as confidential.
• Privacy. Handling of personal information in line with the organization's commitments.

There are two types of report. A Type 1 report gives the auditor's opinion on whether the controls were suitably designed at a single date. A Type 2 report covers a period, commonly six to twelve months, and gives an opinion on whether the controls also operated effectively throughout it. The auditor tests samples of activity, such as whether access was removed promptly when staff left.

A Type 1 report is often a first step for a young company. Customers with significant exposure generally ask for Type 2, and they expect a new one each year so that there is no long gap in coverage.

A report has several standard parts: the auditor's opinion, a written assertion by management, a description of the system and its boundaries, and, in a Type 2 report, a table of each control, the tests performed and the results. Any failures appear as exceptions, and serious ones lead to a qualified opinion.

Two sections deserve attention from readers. Complementary user entity controls list what the customer must do for the controls to work, such as managing its own user accounts. The treatment of subservice organizations explains whether suppliers the vendor relies on, such as a cloud host, are covered or carved out. Reports are restricted documents, shared under a confidentiality agreement. A shorter SOC 3 report covers the same ground for general distribution without the detailed tests.

SOC 2 is sometimes confused with other reports and certifications.

A SOC 1 report addresses controls relevant to a customer's financial reporting and is used by the customer's own auditors. Processors that hold or move client money are often asked for both SOC 1 and SOC 2. ISO/IEC 27001 is an international standard under which an organization's information security management system is certified, resulting in a certificate, not a detailed report of tests. The PCI DSS is a prescriptive standard required by the card networks for any entity that stores, processes or transmits card data. It is narrower in scope and mandatory within that scope, so a company handling cards needs PCI compliance whether or not it has a SOC 2 report.

Banks are held responsible by their supervisors for the activities they outsource. Guidance on third-party risk expects a bank to assess a provider's controls before engagement and on an ongoing basis, and a SOC 2 Type 2 report is the most common evidence. In a bank-fintech partnership, the sponsor bank typically requires the fintech company and its key vendors to supply reports each year as part of outsourcing oversight.

Reviewers within a vendor risk management function check the period covered, the categories included, whether the system described matches the service being bought, any exceptions and management's response, and the user controls they must implement themselves. Where the report period ended some months ago, the vendor may be asked for a bridge letter confirming that nothing material has changed.

The report has well-known limits. The organization selects the scope and writes its own controls, so two reports are not directly comparable, and a narrow scope can leave important systems out. It describes the past and offers no guarantee against a later data breach. The quality of audit firms varies, and the growth of automated compliance tools has raised concerns that some reports involve limited testing. A SOC 2 report is therefore treated as one input to due diligence, alongside questionnaires, penetration test results, service level agreement terms and financial checks.

• AICPA and CIMA