A SOC 2 Type 2 report is a written opinion from an independent auditor on whether a service organisation's controls were suitably designed and operated effectively over a set period, usually several months, measured against the AICPA's trust services criteria. The CertReports index tracks specific fields for every one of these reports it lists: the observation period, the auditor's firm name, which trust services criteria were in scope and any exceptions the auditor noted. Those fields are what separate a genuine SOC 2 Type II report from a vendor simply writing a marketing badge on a web page, a claim examined in There is no such thing as "SOC 2 certified". This article walks through what the report contains, what the audit involves, and how to tell a real one from a badge.
What a SOC 2 Type 2 report actually is
SOC stands for System and Organization Controls, a reporting framework defined by the American Institute of Certified Public Accountants. A SOC 2 report describes a service organisation's own system, meaning its infrastructure, software, people, procedures and data, and gives an auditor's opinion on the controls that protect that system. A Type 2 report covers a period of time, commonly three to twelve months, and tests whether the controls actually operated as described throughout that window, not just whether they were designed on paper. That distinction is the whole point of the report, and it is covered in more depth in SOC 2 Type I vs Type II.
The report itself is not issued by AICPA and it is not a pass or fail certificate. It is produced by a licensed CPA firm, addressed to the service organisation and its specified users, and it stays confidential by default. A vendor can choose to share it under NDA, publish a summary, or say nothing at all. None of that changes what the underlying document is: an audit opinion with a defined scope and a defined time window.
The five trust services criteria
Every SOC 2 report is scoped against one or more of five trust services criteria. Security is mandatory for any SOC 2 engagement and covers the Common Criteria: access control, change management, risk assessment and monitoring. The other four are optional and chosen by the vendor based on what it wants to demonstrate.
- Security: protection against unauthorised access, the baseline criterion required in every report
- Availability: whether systems are available for operation and use as committed
- Processing integrity: whether system processing is complete, accurate and timely
- Confidentiality: protection of information designated as confidential
- Privacy: handling of personal information in line with the organisation's stated commitments
A vendor can hold a Security-only report and still describe it as SOC 2. The extra criteria are additions, not upgrades, and a buyer reviewing the report needs to check which ones were actually in scope rather than assume all five were tested.
Type I versus Type II, the difference a buyer actually needs
A Type I report is a snapshot: the auditor confirms that controls were suitably designed as of a single date. A Type II report tests those same controls over a period and reports on whether they operated effectively throughout, including any times they did not. That is why a Type II report is generally considered stronger evidence for a vendor risk review, and it is also why the two get confused in sales conversations.
| Feature | Type I report | Type II report |
|---|---|---|
| What is tested | Control design at one point in time | Control design and operating effectiveness |
| Time covered | A single date | An observation period, typically 3 to 12 months |
| Evidence of failures | Cannot show exceptions over time | Can and often does show exceptions with remediation notes |
| Typical buyer confidence | Lower, treated as a starting point | Higher, treated as ongoing evidence |
| Common use case | First-year audit before a full Type II cycle | Annual renewal, the standard expectation for enterprise deals |
Type I and Type II test the same controls differently; only Type II covers a period.
The fields that separate a real report from a marketing claim
This is where the index angle matters. A badge or a line of marketing copy tells you nothing about scope or time. A real report, or even a reliable summary of one, should let you answer five questions without opening the PDF.
| Field | What a genuine Type II report shows | What a marketing claim usually shows |
|---|---|---|
| Report type | States Type I or Type II explicitly | Implies full coverage with no distinction between Type I and Type II |
| Observation period | Specific start and end dates, for example 1 January to 30 June | No dates given |
| Auditor name | Named CPA firm with a signed opinion | Rarely named, sometimes just independent auditors |
| Criteria in scope | Lists which of the five trust services criteria applied | Implies all controls were tested, without detail |
| Exceptions | States no exceptions noted or lists specific exceptions and remediation | Never mentioned |
| Distribution | Restricted, shared under NDA or to specified users | Public badge, often with no underlying document offered |
Fields the CertReports index checks for every SOC 2 report it lists.
If a vendor cannot produce an observation period and an auditor name on request, there is no public evidence that a Type II engagement took place at all, whatever the website says.
Why a certification claim is the wrong phrase
AICPA does not certify organisations and SOC 2 has no certificate, no registry number and no pass mark. What exists is an attestation report with an auditor's opinion, which can be unqualified, qualified, or in rare cases adverse. Saying a company is "SOC 2 certified" is a category error, similar to saying a vendor is "HIPAA certified" when HIPAA relies on a signed business associate agreement rather than a certificate. The practical takeaway for a buyer is simple: treat such a phrase as a prompt to ask for the report, not as evidence in itself. The SOC 2 framework page lists vendors with public evidence rather than public claims, which is a useful first filter.
A SOC 2 report describes a service organization's system and the suitability of the design and operating effectiveness of its controls to meet the trust services criteria over a specified period.
What a trust centre shows, and what it still leaves out
Trust centres are a faster way to see what a vendor is willing to state publicly, but they summarise rather than replace the report. A row for SOC 2 that names the report type is more informative than a badge, and it is worth checking whether that row sits next to other frameworks that help confirm the vendor takes its public evidence seriously, such as a stated ISO 27001 certificate or an active Data Privacy Framework listing. The card below shows how a stated report type appears next to other frameworks on a live trust centre entry, which is the kind of detail a marketing badge never carries.
Paylocity · Trust report
Finance and accounting · Public evidence as of 2 Nov 2026
Framework overview
CertReports state for each framework with public evidence: 1 verified, 3 vendor-stated.
3Documents and agreements
Legal and review documents Paylocity publishes or offers, as of 30 Sep 2026.
- Business associate agreement · Public
- Subprocessor list · On request
- Privacy policy · Public
1Security practices
Public statements from Paylocity, shown as statements, not attestations, as of 30 Sep 2026.
- Penetration testing · report available
How to verify a SOC 2 Type 2 report yourself
- 1
Ask for the report, not a summary
Request the full report under NDA if it is not public. See how to get a vendor's SOC 2 report for how AWS, Azure and most SaaS vendors handle this. - 2
Check the report type on the cover page
Confirm it says Type II and states an observation period, not a single as-of date.
- 3
Read the auditor's opinion section
Confirm the opinion is unqualified and note the named CPA firm, which should also appear in the auditors directory. - 4
Scan Section III for exceptions
Look for the control activities table and read any exceptions the auditor noted, along with management's response.
- 5
Check the gap since the period ended
If the observation period ended months ago, ask whether a bridge letter covers the gap, explained in what is a bridge letter.
A full walkthrough of the report structure, including which sections matter most for a buyer with limited time, is covered in how to read a SOC 2 report.
- Type I or Type II
- Two report types exist
- Only Type II tests operating effectiveness over a period
- 5
- Trust services criteria available
- Security is mandatory; the other four are added at the vendor's choice
- 3 to 12 months
- Typical observation period length
- Set by the service organisation and tested by the auditor, not fixed by AICPA
- 0
- Certificates AICPA issues to vendors
- AICPA accredits CPA firms as auditors; it does not certify the organisations being audited
Who signs the opinion: auditors and accountability
The auditor's name matters because the opinion is a professional liability, not a logo. CPA firms that perform SOC 2 engagements range from large national firms to smaller specialist practices, and the firm's name should appear on the report cover and in the opinion letter. If a vendor cannot or will not name the firm that performed the audit, treat that as a gap rather than an oversight. Comparing auditor names against known practice is one of the quicker checks a reviewer can run, and it pairs well with the rest of a structured review such as the one described in a 30-minute vendor security review using public evidence.
A Type II report is not a one-time event
Observation periods end, and a vendor's next report covers a new window. A report from eighteen months ago says nothing about current control operation unless it is paired with a current bridge letter or a newer report. Check the dates before relying on the document.
People also ask
What is soc 2 type 2?
SOC 2 Type 2 is an independent auditor's report confirming that a service organisation's controls, scoped against one or more AICPA trust services criteria, were both suitably designed and operating effectively throughout a defined observation period, typically three to twelve months. It is not a certificate and there is no public pass or fail mark, only the auditor's written opinion inside the report itself.
What is soc 2 type 2 report?
A SOC 2 Type 2 report is the physical document produced by a CPA firm after the audit. It includes a description of the system, management's assertion, the auditor's opinion, the trust services criteria in scope, a table of control activities tested and any exceptions noted. The report names the observation period and the auditor, and it is normally shared under NDA rather than published in full.
What is soc 2 type 2 audit?
The audit is the engagement itself: a CPA firm reviews a service organisation's controls against chosen trust services criteria, gathers evidence across an observation period, and tests whether those controls actually operated as described, not just whether they were documented. The audit concludes with the auditor issuing an opinion, which becomes the report. It typically follows an earlier Type I audit or several months of control operation.
What is soc 2 type 2 attestation?
Attestation is the formal term for what the auditor provides: a professional statement about the reliability of management's assertion regarding its controls. SOC 2 is an attestation engagement under AICPA standards, meaning the CPA firm attests to the design and operating effectiveness of controls rather than certifying the company. The resulting SOC 2 Type II report is the attestation document itself.
Solomon Amos · Founder, CertReports
Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.
Read next on CertReports
You might also like
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is SOC 3, and Why Do Vendors Publish It Instead of SOC 2?
Solomon Amos · 10 Oct 2026 · 9 min read
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read