SOC 2 report for accounting software: how to read one

A SOC 2 report for accounting software is an independent CPA's examination of the vendor's controls. Read it in five places: the report type (Type 2 tests controls over a period), the dates, the auditor's opinion, any exceptions in the tested controls, and the controls the report expects your firm to run. Then record what you found.

What is a SOC 2 report for accounting software?

A SOC 2 report for accounting software is a report from a licensed CPA firm on the controls a software vendor uses to protect the systems and data it handles for customers. It is built on the AICPA's trust services criteria: security, availability, processing integrity, confidentiality and privacy. It is an examination, not a certificate.

The AICPA guide SOC 2 Reporting on an Examination of Controls at a Service Organization (updated as of Oct. 15, 2022) explains why the report exists: customers of an outsourced service "usually need information about the design, operation, and effectiveness of controls," and so they "often request a SOC 2 report from the service organization."

Who signs it matters. In the Journal of Accountancy podcast on quick-turn SOC engagements (Apr. 30, 2026), the AICPA's Amy Pawlicki says "SOC 2 is not a certification. It's actually an examination-level attestation engagement signed off on by a licensed CPA." She adds that an engagement "can cover one, two, three, four, or all five" of the criteria. A vendor saying "we are SOC 2 certified" is using the wrong words, so ask for the report itself.

Expect to sign a nondisclosure agreement first. The Journal of Accountancy article Promises of 'fast and easy' threaten SOC credibility (Feb. 1, 2026) says SOC 2 reports "are restricted to specified parties with sufficient knowledge and understanding of the service organization's system." The AICPA's SOC 3 page (read Oct. 16, 2026) describes SOC 3 as the general use version that can be freely distributed because it does "not provide the same level of detail."

The post on vendor reports for a secure portal covers the first three checks for any portal: the period, the categories in scope and the system described. This post goes further into the report, section by section.

SOC 2 Type 1 vs Type 2 reports for accounting software

A SOC 2 Type 1 report looks at whether the vendor's controls were suitably designed as of one date. A Type 2 report also tests whether those controls operated effectively across a period, with a start date and an end date. For accounting software that will hold client files all season, the Type 2 report says more.

An AICPA Insights piece, Maintaining high standards for SOC engagements (Dec. 6, 2023), puts the difference in one line: SOC reporting covers "the design (and in type 2 report, the operating effectiveness)" of controls. A panelist adds that "For a type 1, the service auditor is evaluating controls as of a specific date."

In practice, a Type 1 report tells you the vendor had a written control on, say, June 30, 2026: "access to production data requires approval." A Type 2 report tells you the auditor sampled access requests from January through June and checked whether each one was approved. The first shows the control existed. The second is evidence it was followed.

A vendor that hands over a Type 1 report has still had an independent CPA look at its controls. Ask whether a Type 2 examination is under way, when the first Type 2 period starts and ends, and put that date on the firm's calendar.

Reading the auditor's opinion and exceptions in a SOC 2 report

The auditor's opinion is the CPA firm's conclusion on the vendor's system description and controls in a SOC 2 report. Exceptions are individual test results where a control did not work as described. Read the opinion for its overall conclusion, then read every exception and the vendor's response to it.

The opinion comes first because everything else depends on it. In the Journal of Accountancy podcast on quick-turn SOC engagements (Apr. 30, 2026), the AICPA's Amy Pawlicki warns about technology vendors "allegedly promising clean opinions and drafting boilerplate reports." A clean opinion is the result a reader hopes for. The AICPA SOC 2 Report Walkthrough course lists "Report opinion types" among the things a user must recognize. If the opinion is anything other than clean, read the paragraph that explains why before reading further.

Exceptions sit in the section that lists each control, the auditor's test and the result. Read that section even when the opinion is clean. An example: one missed quarterly access review out of four. Treat each exception as a question:

• Does the failed control touch the data your firm will upload, such as access to customer files?
• Was it a single miss or a pattern across the period?
• What did the vendor say it changed, and when?

Management responses are the vendor's own words placed next to the exception. Read them as the vendor's explanation, and ask what evidence backs any fix they describe. If the response says a fix was made after the period ended, ask how the next report will show it.

Watch for a report that reads like a template. The Journal of Accountancy article Promises of 'fast and easy' threaten SOC credibility (Feb. 1, 2026) quotes a member of the AICPA's SOC 2 Working Group: "You can compare any five of their reports, and they're all exactly the same, with a different client logo on it." The same article suggests asking: "Does it seem the report is tailored to the specifics of the system being examined?" The Journal of Accountancy article AICPA guides peer reviewers to address SOC 2 risks (May 14, 2026) says engagements with "identical reports, risk assessments, sample sizes, and testing procedures" are not performed in accordance with the standards.

Which parts of a SOC 2 report fall on the accounting firm?

Two parts of a SOC 2 report fall on the accounting firm or on companies outside the vendor. Complementary user entity controls are controls the vendor assumes each customer runs, such as removing departed staff from the software. Subservice organizations are other companies the vendor relies on, such as its cloud host, which the report may include or carve out.

The AICPA course SOC 2 Report Walkthrough lists the items a report user should learn to find, including "complementary user entity controls (CUECs)," "complementary subservice organization controls (CSOCs)," and "Inclusive versus carve-out methods of reporting on controls at subservice organizations."

User entity controls are where many firms skip a step. A typical list might read (example):

• The customer approves which of its staff get user accounts.
• The customer removes accounts promptly when staff leave.
• The customer requires multi-factor authentication for its users.
• The customer reviews access reports the software provides.

If the firm does none of these, the vendor's controls do not add up to the protection the opinion describes. Copy the list into the firm's own procedures, name an owner for each, and train staff on them. The post on security awareness training for accounting staff covers how to make that training stick.

Subservice organizations need their own look. Find each one named in the report, note whether the report uses the inclusive or the carve-out method for it, and ask the vendor what evidence covers that company's controls and whether the vendor reviews it. The firm's own controls, such as deciding who gets an account, stay the firm's job for every tool that touches client files. That includes a document intake tool such as Schema CPA, which reads the W-2s, statements and invoices clients send.

When a SOC 2 report is out of date: bridge letters and coverage gaps

A SOC 2 report goes out of date because it only covers the period or date it names. The time between the end of that period and today is a coverage gap. Ask the vendor for a bridge letter and the date of its next report. Read who signed the letter, which period it covers and whether anything changed.

In the Journal of Accountancy podcast on quick-turn SOC engagements (Apr. 30, 2026), the AICPA's Amy Pawlicki says "it's also important that the services be done annually as things can change over time." So the first check is simple arithmetic. If the report period ended on Dec. 31, 2025 and today is Oct. 16, 2026 (example), the gap is more than nine months.

The AICPA course SOC 2 Report Walkthrough lists "Bridge letters" among the items a report user should understand. When a vendor sends one, check three things:

• Signer. Is it signed by the vendor's management or by the CPA firm, and does it describe any testing behind it?
• Period. Does it run from the end of the last report period to a recent date, without a hole?
• Changes. Does it say whether controls, systems or subservice organizations changed since the report?

Then ask when the next report is due. A vendor that cannot name the next period's end date has told you something too.

Accounting software vendors with no SOC 2 report

An accounting software vendor with no SOC 2 report is not automatically ruled out, but the firm has to gather other evidence and record why it accepted the vendor. Ask for a SOC 3 report, a completed security questionnaire, written answers about access, encryption and incident notice, and the date the vendor expects an examination.

The AICPA's SOC landing page, System and Organization Controls: SOC Suite of Services (read Oct. 16, 2026), notes that the AICPA "is looking into allegations published anonymously about the business practices of a compliance vendor that offers Systems and Organization Control (SOC) services." That is a reason to check a new report's CPA firm as carefully as the vendor. The Journal of Accountancy article Promises of 'fast and easy' threaten SOC credibility (Feb. 1, 2026) suggests vetting "the CPA firm that will perform the SOC 2 attestation," including "its size, capacity, and client references."

Vendor oversight is one of the required elements of a written information security plan, and the post on the required elements of a tax preparer WISP explains where it fits. The worksheet below is one way to keep the record that element calls for.

SOC 2 review worksheet (example)

File the worksheet with the vendor contract. When the next report arrives, fill in a new copy and compare the two.

A vendor review is one layer. The post on ransomware protection for accounting firms covers the firm's own systems: backups, patching and remote access.