How to read a SOC 2 report or an ISO certificate without being caught out

It happens more often than it should. Someone in procurement or compliance receives a document from a supplier — perhaps a hundred pages labelled “SOC 2 report”, perhaps a two-page PDF with a stamp reading “ISO 27001 certified” — and files it away as if both documents meant the same thing, and as if their existence alone settled the question of whether the supplier is secure.

It does not. Sometimes it partially answers the question. And in some cases, a careless reading can lead an organisation to assume a level of assurance that was never actually verified for the specific service being used. This article is a practical guide to avoiding that error — without requiring a background in auditing.

The SOC 2 report: structure and what to actually read

SOC 2 reports are produced by independent audit firms operating under the standards of the AICPA (American Institute of Certified Public Accountants). They assess whether a service organisation's controls meet the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. The most common variant covers security alone, though each provider determines which criteria to include in scope.

A SOC 2 report has five sections. Knowing which ones to read carefully — and which provide context rather than substance — is the core skill.

The auditor's opinion is the first section and the most immediate data point. An unqualified opinion means the auditor found no significant deviations. A qualified opinion signals areas where reservations exist. An adverse opinion means controls failed in material respects. A disclaimer of opinion means the auditor could not obtain sufficient information to form a view. Most reports circulating in due diligence processes carry an unqualified opinion — but that does not close the analysis.

The system description is where you need to read carefully. This section defines which systems, services, locations, and data flows fall within the scope of the report. This is where the most common trap sits: the service your organisation uses may not be included. If a supplier provides a SOC 2 report covering their document management platform, but you use their data integration API, the thing that actually matters to you may be outside the audited scope entirely. Read the system description with one specific question in mind: “Is what we actually use covered by this report?” That is the first useful filter.

The tests of controls section is the most extensive — often two-thirds of the document — and the section that most intimidates those unfamiliar with its format. It is typically presented as a table: the Trust Services criterion, the control implemented by the provider, the auditor's test procedure, and the result. The result column is where exceptions appear. An exception does not automatically mean the supplier is insecure, but it does mean a specific control failed during the assessment period. Read what failed, how often, and what the supplier said in response in the supplementary information section.

Type I versus Type II: the distinction that matters most

Before opening the content at all, there is a fundamental distinction that determines how much weight to give the report.

A SOC 2 Type I report assesses whether a provider's controls were suitably designed at a specific point in time. It is a snapshot. The auditor visited, reviewed the documentation, and declared that, on that date, the controls appeared appropriate for the stated objectives. There is no evidence that those controls have ever actually operated.

A SOC 2 Type II report assesses whether those controls operated effectively over a defined period — typically six or twelve months. It is a film, not a photograph. The auditor performed testing against real transactions from the coverage period. A Type II over twelve months carries significantly greater evidential weight than a Type I over any period.

In supplier assessments, accepting a SOC 2 Type I as equivalent to a Type II is a common error. Type I is a reasonable starting point for a new supplier relationship, but for critical suppliers the document that carries real value is the Type II — and it is worth confirming that the coverage period has not expired. A Type II report from eighteen months ago is materially less relevant than a recent one.

Also check who signed the report. SOC 2 reports must be issued by audit firms licensed by the AICPA. Not every security consultancy can produce a valid SOC 2 report. If the issuing firm is not a recognised CPA practice, the document does not meet the framework's standards, regardless of how professionally it is formatted.

The ISO 27001 certificate: four things to check before filing it

An ISO 27001 certificate is typically two pages. The useful information is concentrated in a small number of fields, each worth reviewing systematically rather than skimming.

The scope is the most critical field and the most consistently overlooked. An ISO 27001 certificate covers an information security management system within a boundary that the organisation itself defines. That boundary might be the entire company, a single business unit, a specific service, or a defined geographic location. A supplier may be certified for their electronic invoicing platform while having no certification coverage whatsoever for the data storage service your organisation actually uses. Confirming that the certificate scope includes the relevant service or infrastructure is not optional — it is the whole point of reading the certificate.

The validity date and certification cycle is the second field. ISO 27001 operates on a three-year cycle: an initial certification audit, followed by annual surveillance audits in years one and two, and a recertification audit in year three. A certificate may be within its three-year window while having a lapsed surveillance audit — meaning no one has verified that the management system is still functioning as required. If the supplier cannot demonstrate that annual surveillance audits have been completed, the certificate has less value than its expiry date implies.

The certification body and its accreditation is the third element. Not all bodies issuing ISO 27001 certificates operate with the same rigour or carry the same credibility with demanding clients. National accreditation bodies that oversee certification in their respective jurisdictions include UKAS in the United Kingdom, DAkkS in Germany, COFRAC in France, and ENAC (Entidad Nacional de Acreditación) in Spain. All are members of the International Accreditation Forum (IAF) and their accreditations are mutually recognised. A certificate issued by a certification body not accredited by an IAF member carries less weight. It is not necessarily fraudulent, but it has not been subject to the external oversight that ensures consistency in the audit process. For contracts with public-sector bodies or regulated entities, the accreditation status of the issuing body is routinely scrutinised.

Authenticity verification is the fourth step and the one most frequently skipped. The majority of accredited certification bodies maintain public online registers where any certificate — identified by the serial number shown on the document — can be confirmed as current and valid. UKAS, DAkkS, and ENAC each publish searchable directories. Taking thirty seconds to look up the certificate number in the issuing body's register is the only way to confirm that the document in hand corresponds to a real, active certification. It is not a disproportionate level of scepticism. It is basic due diligence.

What neither document answers on its own

Both the SOC 2 report and the ISO 27001 certificate are evidence that, at a specific point in time and within a defined scope, a provider's controls met certain criteria. They are not guarantees that those controls continue to operate today. They do not cover every risk dimension of the relationship. And they do not substitute for a judgement about whether this specific supplier, for this specific use case, has an adequate level of control.

A supplier with an ISO 27001 certificate whose scope excludes the service you actually use is no more useful to your assessment than an uncertified supplier. A SOC 2 Type II with multiple exceptions in controls relevant to your data type calls for a conversation with the supplier — not a tick in the due diligence folder. A certificate issued by a body without recognised accreditation carries limited evidential weight when presented to auditors or regulators.

Reading these documents with analytical attention — not with suspicion, but with the same critical focus you would apply to any technically significant piece of data — is what distinguishes compliance and security teams that genuinely manage risk from those that manage paperwork. The documents exist to be read, not filed.