A SOC 2 Type II report is an independent examination, performed by a licensed CPA firm under standards set by the American Institute of Certified Public Accountants (AICPA), that tests whether a service organization’s security and related controls actually operated effectively over a sustained period of three to twelve months.1AICPA & CIMA. System and Organization Controls: SOC Suite of Services It’s the document enterprise buyers ask for when they want proof that a vendor’s security practices work in daily operation, not just on paper. For most B2B technology companies, it has become the default credential for winning and keeping large customers.
How Type II Differs from Type I
A SOC 2 Type I report evaluates whether your controls are properly designed at a single point in time. The auditor looks at the environment on a specific date and confirms that the right controls exist. A Type II goes further: it tests whether those controls actually operated effectively across a window of time, usually three to twelve months.
That distinction is the whole reason Type II carries more weight. A Type I might show that a company had a solid access control policy on June 1. A Type II shows that the policy was enforced every day from January through December. Customers and their auditors strongly prefer Type II because a snapshot tells you very little about how an organization behaves over months of real operation.
Many organizations begin with a Type I to demonstrate control design and then move to Type II for subsequent reports. Some skip Type I entirely if their controls are mature enough.
What the Report Actually Covers
Every SOC 2 engagement is built around the AICPA’s Trust Services Criteria, which define five categories of controls.2AICPA & CIMA. 2017 Trust Services Criteria with Revised Points of Focus 2022 Security is mandatory in every report. The other four are selected based on the nature of the services provided and what customers need assurance about.
- Security (Common Criteria): Protections against unauthorized access, physical and logical. Covers firewalls, intrusion detection, employee background checks, access provisioning, and related controls. These underpin every SOC 2 report.
- Availability: Whether systems are operational and accessible as promised in service level agreements. Most relevant for infrastructure customers depend on around the clock.
- Processing Integrity: Whether the system processes data completely, accurately, and on time. A payroll processor or financial data aggregator would typically include this; a company that only stores files might not.
- Confidentiality: How information designated as confidential is restricted and protected, including intellectual property, financial data, and anything under nondisclosure obligations.
- Privacy: How personal information is collected, used, retained, disclosed, and disposed of in line with the published privacy notice. Applies when the service handles personal data from consumers or end users.
Choosing which criteria to include is a strategic decision. A cloud infrastructure provider might select only Security and Availability. A healthcare analytics company would likely include all five. Organizations often map their criteria against frameworks they already follow, like ISO 27001 or the NIST Cybersecurity Framework, to avoid duplicating work.
What’s Inside the Report
A Type II report follows a standard structure. Whether you’re the company being audited or a customer reviewing someone else’s report, knowing what to look for in each section matters.
The Auditor’s Opinion
The report opens with a management assertion and then the independent auditor’s opinion, which is the single most important section for anyone evaluating the document. The auditor can issue one of four opinions:
- Unqualified: Controls were fairly presented and operated effectively throughout the review period. This is the outcome every organization wants.
- Qualified: Most controls operated effectively, but the auditor found specific areas that fell short. The report details what those were.
- Adverse: Material failures existed in the control environment. The reader cannot place meaningful reliance on the controls.
- Disclaimer: The auditor could not gather enough evidence to form an opinion.
A qualified opinion does not automatically mean the organization is untrustworthy. Testing exceptions happen, and an auditor might note isolated deviations while still concluding the overall control environment is reliable. Read the specifics. A single employee who missed a training deadline is a very different finding from an unencrypted production database.
System Description
This is a narrative of the infrastructure, software, personnel, procedures, and data that make up the service being audited. It defines the boundaries of the engagement so readers understand exactly what was and was not covered. It also identifies subservice organizations (third-party vendors the service depends on) and lists complementary user entity controls.
Tests of Controls and Results
This is where the Type II report earns its reputation. A detailed table lists each control activity, the specific test the auditor performed, and the result. For a control stating that all production changes require peer review approval, the auditor’s test would describe pulling a sample of change records from the review period and checking whether each had documented approval. The result column shows whether the control operated effectively or notes exceptions.
This transparency is what lets you assess whether an examiner actually found evidence of the organization’s practices working, rather than just taking the organization’s word for it.
Complementary User Entity Controls
Often overlooked, this section lists the controls the service organization expects its customers to maintain. A SaaS provider might require customers to enforce multi-factor authentication, restrict administrative access, and review user access lists periodically. If you’re reviewing a vendor’s report and the CUECs include responsibilities your organization doesn’t fulfill, that gap creates risk the vendor’s report alone doesn’t cover. Treat the CUEC list as a checklist for your own internal controls.
Subservice Organizations
Almost every modern service depends on third-party vendors like cloud providers and payment processors. Reports usually handle these using the carve-out method, meaning the vendor’s controls are excluded from the audit and identified separately, with customers expected to review the vendor’s own SOC 2 report. Less commonly, the inclusive method pulls the vendor’s controls into the audit scope.
How Long the Report Stays Valid
A SOC 2 Type II report is generally treated as current for twelve months after the observation period ends. A report covering January through December 2025 will be relied on through approximately December 2026. After that, it’s considered stale and prospective customers will want a new one.
Most organizations run their audits on a continuous annual cycle, with each new observation period picking up where the last one ended. This produces an unbroken chain of assurance. When a gap between reports is unavoidable, organizations sometimes issue a bridge letter (also called a gap letter) as a self-attestation that controls have continued to operate effectively since the last report ended. The standard expectation is that a bridge letter covers no more than three months, and it is not a substitute for the actual report. The organization drafts and signs it themselves; no auditor has verified the claims.
Report Distribution
A SOC 2 Type II report is not a public document. Unlike a SOC 3 report, which can be posted openly on a website, a SOC 2 is restricted to specified parties: current and prospective customers, their auditors and business partners, and regulators with the knowledge to interpret it. The report itself contains a restricted-use paragraph naming who may receive it.
In practice, organizations share reports under nondisclosure agreements. A prospective customer signs an NDA and receives the report through a secure portal or encrypted delivery. Because the report contains detailed descriptions of the control environment, testing procedures, and any exceptions, it reveals far more about a security posture than any public certification badge could.
Who Needs a SOC 2 Type II Report
SOC 2 reports are designed for service organizations: companies that handle other businesses’ data. The most common candidates are SaaS providers, cloud hosting companies, data centers, managed IT service providers, payment processors, and healthcare data platforms.
Nothing in federal law requires a SOC 2 report the way HIPAA mandates certain healthcare safeguards or PCI DSS governs payment card data. SOC 2 is a market-driven standard. The pressure comes from enterprise customers, cyber insurance underwriters, and business partners who want documented proof that controls work. That pressure is strong enough that for most B2B technology companies, going without a SOC 2 Type II report effectively locks you out of deals with larger organizations.
What It Costs and Who Can Issue It
Only a licensed CPA or CPA firm can issue a SOC 2 report. The AICPA sets the professional standards governing these engagements, and the examining firm must have the relevant attestation competency.3AICPA & CIMA. SOC Logo for CPAs – Registration and Guidelines Consultants and compliance platforms can help you prepare, but they cannot issue the report itself.
The formal audit engagement typically runs $20,000 to $60,000 for small to mid-sized companies, though complex organizations with multiple data centers or a broad set of Trust Services Criteria can see fees reach $100,000 or more. Total costs, including readiness assessments, compliance automation tooling, internal staff time, and remediation, commonly land between $30,000 and $150,000 for a first-time report.
Cost drivers include the number of Trust Services Criteria in scope, infrastructure complexity, the number of subservice organizations, the length of the observation window, and whether the audit is a first-time engagement or a renewal. When selecting an auditor, look for firms with experience in your industry and technology stack. A firm that primarily audits financial institutions may not be the best fit for a cloud-native SaaS company, and the reverse is equally true.
Audit and preparation costs generally qualify as ordinary and necessary business expenses under Internal Revenue Code Section 162, making them deductible in the year incurred. Retain invoices and documentation of the business purpose to substantiate the deduction.
Preparing for and Going Through the Audit
Most of the real work happens before the auditor arrives, often months in advance. Controls must already be operating before the observation window opens, because every day within that window is in scope. If a control was supposed to be in place and wasn’t for two weeks in the middle, the auditor will find it.
The first decision is the length of the observation window. First-time reports often use three to six months to limit evidence collection while still demonstrating operating effectiveness. Established organizations move to a twelve-month window for continuous annual coverage.
Documentation requirements are extensive: descriptions of how each control meets the selected Trust Services Criteria, personnel access lists, change management logs, evidence of risk assessments, incident response records, and proof that employee onboarding procedures were consistently followed. Many organizations now use compliance automation platforms that integrate with cloud infrastructure, identity providers, and ticketing systems to collect evidence continuously rather than manually at audit time.
A readiness assessment before the formal audit is common and highly recommended. This practice run identifies gaps in documentation or control design before the observation window opens. Fixing a missing control before the period starts is straightforward; discovering it midway through means either extending the timeline or disclosing the gap.
Once the observation window closes, fieldwork begins. The auditor performs walkthroughs, observes staff performing specific tasks, and pulls samples of records to test whether controls operated as described. Sampling is central to the process: rather than examining every transaction, the auditor selects a random subset from the review period.4Public Company Accounting Oversight Board. AS 2315 – Audit Sampling A single missed approval in an otherwise clean sample is a noted exception; a pattern points to a control that isn’t actually working.
The full process from the start of fieldwork to final report issuance typically takes six to ten weeks. Complex engagements run longer. Staying responsive to auditor questions and maintaining a centralized evidence repository shortens the timeline considerably.