thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

SOC Type 2 Report

SOC report covering both design and operating effectiveness of controls over a specified period.

Definition

Type 2 reports include the auditor's tests of controls and results, including exceptions, over a review period, typically 6 to 12 months. They provide much greater assurance than Type 1 and are the norm for vendor due diligence.

Example

A Type 2 report notes 2 exceptions out of 25 sampled terminations where access was removed late.

Exam tip

Review exceptions, the period covered, and CUECs, not just the opinion.

Related terms