by Assurion Services | Oct 5, 2026 | SOC 2
A qualified opinion means the service auditor concluded that, except for one or more specific matters, the controls were suitably designed and operating effectively. The word “except” is the whole point — the auditor is naming something that is wrong and...
by Assurion Services | Oct 5, 2026 | SOC 2
The majority of control failures we report are not security failures. Nobody was breached, nothing was exposed, and in many cases the organisation is doing something perfectly sensible. The exception exists because the policy said the review happens quarterly and it...
by Assurion Services | Oct 5, 2026 | SOC 2
The honest summary of a second year SOC 2 is that the preparation gets much easier and the evidence gets harder. You already have a system description, a control matrix and a relationship with an auditor. What you do not have is the excuse that applied the first time...
by Assurion Services | Sep 2, 2026 | SOC 2
Somewhere in the middle of almost every SOC report there is a table that readers skim past on their way to the test results. It lists things the customer is expected to do. Those are complementary user entity controls, and they are the part of the report that quietly...
by Assurion Services | Sep 2, 2026 | SOC 2
Your SOC 2 Type 2 covers 1 January to 31 December. It is now March, a prospect is in a security review, and their vendor risk team wants to know what happened in the eleven weeks since the period ended. The usual answer is a bridge letter, and it will probably satisfy...
by Assurion Services | Sep 2, 2026 | SOC 2
If your platform runs on a cloud provider, uses a managed data centre, or hands part of the service to a specialist partner, your SOC report has to say something about them. You have two options for how. The carve-out method names the vendor, describes what you rely...
