Read it for accuracy, not just typos. Your draft SOC 2 report describes the service and controls that customers will use to assess you. This is the time to flag factual errors before the auditor issues the final version.
Management’s review does not give it control over the auditor’s opinion. Raise concerns with supporting facts. Do not remove a finding because it is inconvenient.
Start with the basics
- Is the correct company and service named?
- Are the report type and covered dates correct?
- Does the stated scope match the engagement?
- Are product names and important dependencies accurate?
For example, a product launched after the examination period should not be presented as though it was covered throughout that period.
Ask the owners to check their sections
Have the people responsible for the processes read the relevant descriptions. A coordinator can collect their comments in one place.
Look for statements that are stronger than the actual process. “Every change is reviewed before release” needs attention if the documented process includes a separate emergency-change path. Explain the facts to the auditor rather than quietly smoothing over the difference.
Also check that customer responsibilities are understandable. Readers need to know which actions remain with their own teams. Our customer-controls guide explains why that matters.
Review findings without rewriting history
For a Type 2 report, check the stated test results against the matters discussed during the audit. If a fact appears wrong, identify the item and provide the supporting record.
If management provides a response to a finding, distinguish a completed correction from a planned one. Do not describe management’s response as independently tested unless the report establishes that.
A fix made after a missed review does not make the earlier review happen. Keep the timing clear.
Send one clear set of comments
A simple list is enough:
- Page or section.
- The statement you are questioning.
- The factual correction and supporting evidence.
- The person who can resolve it.
Ask the auditor how it wants comments submitted. Keep the draft restricted to the people who need to review it. Do not send it to prospects as the finished report.
Check the final copy too
Confirm that agreed corrections appear in the issued version. Keep a controlled final copy so sales does not accidentally share an earlier draft. Before distribution, use the SOC 2 report-sharing checks.
Sources: Schellman describes client review before finalization in its SOC 2 reporting process. Its report-reading guide explains management’s assertion, system descriptions and test results. The review checklist above is practical guidance, not a replacement for your auditor’s completion requirements.