SOC 2 Type 2 report
- Term
- SOC 2 Type 2 report
- Exam
- CISA & CISM
- Definition
An independent auditor's report on the design and operating effectiveness of a service organization's controls over a period.
- Explained
A SOC 2 Type 2 report is an independent auditor's opinion on the design and operating effectiveness of a service organization's controls over a period. Users must check the period, scope, carve-outs, exceptions and the complementary user entity controls they are expected to operate.
- In practice
An auditor tested a SaaS provider's access controls from January to December and reports exceptions.
- Often confused with
- SOC 2 Type 1 report
- Exam angle
Check the period, carve-outs and complementary user entity controls.
- Related