Noru

Free template

Vendor SOC 2 report review worksheet

One page to fill in for each vendor report you read: scope, period, opinion, exceptions, the controls it expects from you, and the decision. Auditors ask to see it under CC9.2.

Fill one in per vendor report, and keep it with the report. A filed report with no review record is one of the most common CC9.2 exceptions: the auditor wants to see that someone read it and decided something.

The complementary user entity controls section matters most. Each one is a control the vendor's auditor assumed you run; if nobody owns it, the vendor's report does not cover what you think it covers.

The guide behind it: How to Review a Vendor's SOC 2 Report: A Step-by-Step Checklist

Vendor SOC 2 report review: [vendor name]

Reviewer[Name, role]
Review date[YYYY-MM-DD]
Vendor tier[Critical / high / medium / low]
Service we use[Product, plan, region]
Data the vendor handles[Categories of our or our customers' data]

1. The report

Report type[SOC 2 Type 1 / Type 2]
Service auditor[Firm]
Period covered[start] to [end], or as of [date]
Report issued[YYYY-MM-DD]
Categories in scope[Security, Availability, Confidentiality, ...]

2. Scope check

Does the system the report describes include the product, region and features you actually use?

  • The service we use is in scope: [yes / no / partly, with detail].
  • Regions or data centres we use are in scope: [yes / no].
  • Gaps in scope and what covers them: [e.g. a separate report, contract terms, compensating review].

3. Opinion

Opinion: [unqualified / qualified / adverse / disclaimer].

If qualified: criteria affected [refs] and why [summary].

4. Exceptions

Every deviation listed in the test results, whether or not it changed the opinion.

ControlExceptionVendor's responseImpact on us
[Ref][What the auditor found][Management's response][None / follow up / risk accepted]

5. Complementary user entity controls

Controls the vendor's report expects you to operate. Map each one to your own control and owner.

CUEC in the reportOur controlOwnerIn place
[e.g. Customers manage their users' access][Our access review][Role][Yes / no]

6. Subservice organisations

Subservice organisationMethodDo we need its report
[e.g. hosting provider][Carve-out / inclusive][Yes / no, with reason]

7. Bridge letter

Needed when the report period ended a while ago and the next report is not out yet.

Bridge letter requested: [yes / no]. Received: [date]. Covers to: [date].

8. Decision

Decision: [accept / accept with conditions / escalate / do not use].

Conditions or follow-ups: [actions, owners, due dates].

Next review: [date, usually when the next report is issued].

All templates

FAQ

Frequently asked questions

Talk to us

Do I need a review record for every vendor?

For the vendors in your SOC 2 scope that handle customer data or run part of the system, yes: CC9.2 asks for evidence of review. Low-risk vendors can be covered by a lighter check set in your vendor policy.

What if a vendor only has a SOC 2 Type 1?

Record it and note that the report covers design at a date, not operation over time. Ask when the Type 2 is due, and decide whether the gap is acceptable for the data the vendor handles.

Trust, settled.

Templates are the start. Noru drafts the policies from your own setup, tracks approvals and acknowledgements, and keeps the evidence.

Book a demoMore templates