SOC 2 report example: a sample Type 1, section by section

Download the sample report as a PDF of 92 pages, about 2.5 MB. Nothing to sign up for.

Polara Labs assembled the sample to show the structure and depth of the package an auditor reviews, before anyone pays for one. It is nobody’s report. It is also not a preview of your own results: we do not produce free reports, and this file was not generated from anything you entered. Read it as an anatomy lesson, with this page open beside it.

Section 1: the auditor’s report, which this sample leaves empty

In a real report, Section 1 is the reason the document exists. It is the service auditor’s report: a licensed CPA firm states what it examined, under which standards, and what it concluded.² Only a CPA firm may sign it.³

The sample’s Section 1 holds one paragraph saying that no independent service auditor has issued an opinion, and that every status in the document is management’s own. That is the honest version of a draft. Anything calling itself a SOC 2 report while that section is blank is not one.

For the authoritative layout, the AICPA publishes an illustrative SOC 2 Type 2 report with an illustrative system description. It is available to AICPA members. When an opinion is qualified or adverse, the paragraph that says so sits here too, and what happens when a report has exceptions explains the four kinds.

Section 2: management’s assertion

Management signs this part, not the auditor. In the sample it confirms two things as of March 31, 2026. First, that the description presents the system as designed and implemented, measured against the AICPA description criteria.⁴ Second, that the controls were suitably designed to meet the service commitments under the 2017 Trust Services Criteria for Security.⁵

Read the verbs. “Designed and implemented” and “suitably designed” are Type 1 language. A Type 2 assertion says the controls operated effectively throughout a period. Our management assertion template has both versions, worded line by line.

The sample adds something a real assertion would not. It quotes answers management gave in a readiness questionnaire, each one labeled as management’s representation and not a tested result. Then Section 2.1 lists 51 findings from that intake, with owners. In an issued report, deviations the auditor found appear in the opinion and in Section 4.

Section 3: the description of the system

This is the longest part of most reports, and the one a careful reader spends time on. It is written by the company and evaluated by the auditor against the description criteria. The sample covers what the criteria ask for: infrastructure, software, people, procedures and data, then the system boundary.

Three things in it matter most when you read somebody else’s report:

Subservice organizations

The sample carves out six vendors, from the cloud host to the payment processor, and lists the controls it expects each one to run. Carved out means their controls are not covered by this report. You read their own reports for that.

Complementary user entity controls

Things the customer must do for the vendor’s controls to work, such as managing the access it grants its own staff. If you are the customer, these are your obligations. How CUECs are worded covers the difference between a real one and filler.

The boundary

What is in scope and what is not. The sample names one product and one office and excludes personal devices. A feature outside the boundary is not covered, however close to it it sits.

If you are writing your own, the system description template follows the same order.

Section 4: the criteria and the controls

Section 4 maps each criterion to the controls that meet it. The sample lists every point of focus under the nine common criteria groups, 197 of them, with the control management describes, the basis for its status, an evidence reference, an owner and management’s status. No auditor tested any of it, and the section says so above the table.

This is where Type 1 and Type 2 differ most on paper. A Type 1 report describes controls as designed on one date, so there is nothing to sample. A Type 2 report adds what the auditor did to each control across the period, the sample size, and the result, with every exception written out. That column is what a Type 2 adds. Type 1 versus Type 2 covers when each one is enough.

Section 5 and the appendices

The sample’s Section 5 lists the design deficiencies management disclosed: 21 of 33 in-scope control points carry an exception as of the as-of date. Three appendices follow. Appendix A lists every artifact on file. Appendix B is management’s remediation roadmap, 49 open items with owners and dates. Appendix C traces each intake answer to where it is used.

Real reports vary here. One may close with a section of other information provided by management, which the opinion does not cover. Treat anything after Section 4 as management’s voice unless the auditor’s report says otherwise.

How to read a SOC 2 report a vendor sent you

Six checks, in the order they save you time.

1. Find the opinion paragraph in Section 1. Unmodified, qualified, adverse or disclaimed. If there is no signed opinion, you are not holding a report.
2. Read the date or the period. A Type 1 is as of a date, a Type 2 covers a period. Then check how old a report can be before you ask for a bridge letter.
3. Check which criteria are in scope. Security is always there. Availability or Confidentiality only if the report says so.
4. List the carve-outs. Every carved out vendor is a report you still need.
5. Copy out the CUECs. They are work your team now owns.
6. Verify the firm. Confirm the CPA firm holds a license. How to tell if a SOC 2 report is real walks through the lookup.

Want to see where your own company stands first? The free readiness assessment takes about 15 minutes and returns your readiness score, every gap category counted with exact numbers, and your first findings written out in full. It lives in your account. It is not a report, and nothing downloads.